Managing AWS Auth

paws auth

We use the package paws to interact with AWS. paws also handles the authentication. paws looks for credentials in a few different places, in the following order:

1. “Settings” (aka: function inputs) provided to individual AWS services paws service settings
2. Environment variables paws supported env vars

• You can set the three most important environment variables within R for the current R session like: Sys.setenv(AWS_ACCESS_KEY_ID = "", AWS_SECRET_ACCESS_KEY = "", AWS_REGION = "us-west-2"). Or set them in a variety of ways to be available across R sessions. See the [R Startup chapter][r-startup] of What They Forgot to Teach You About R book for more details.

3. AWS shared credentials file and AWS config file

• The default location for the AWS shared credentials file is ~/.aws/credentials. Look there to see if you have this set.
• The default location for the AWS config file is ~/.aws/config

4. An EC2 instance or IAM role

sixtyfour intializes R6 classes that are the object behind a paws service (e.g., for S3), and during the initialization it attempts to gather credentials following the above order.

sixtyfour does not provide any mechanism directly in the package to modify what credentials are used. However, following the paws docs linked above you can modify what credentials are used by adjusting what credentials you have set.

Some users may have more than one set of credentials - the next section digs into how to approach making sure sixtyfour is using the credentials you want to be using.

Note that the first option above - passing credentials directly as function parameters - we do not use in sixtyfour so that we’re not encouraging secrets being directly put into code where those secrets may show up in public.

For many different auth scenarios see the paws credentials docs.

Setting credentials

It probably makes the most sense to manage your AWS credentials using only one of the above methods. However, you may need to use a combination depending on your needs.

There are various ways to set credentials. Most often - as the paws docs spell out - you will tell paws what creds to use via environment variables. You can do that in various ways:

• You can already have env vars exported globally on your system, and then R will pick those up
• Start R with an env var set just for that R session, for example: AWS_REGION=us-east-1 R, then when you load paws it will use that env var
• You can set env vars within an R session, either globally for the session or perhaps with for exmaple withr::with_envvar, setting a certain set of AWS creds for just the duration of the call block passed in to with_envvar.