#1094 S3 logger: use the default AWS credential chain when no static keys are configured Pull request opened by javuto S3 logger: use the default AWS credential chain when no static keys are configured Problem

logging.CreateLoggerS3

always installed

credentials.NewStaticCredentialsProvider(AccessKey, SecretAccessKey, "")

, even when both values were empty. The sample config (

deploy/config/*.yml

) and the log-sink UI say static keys are optional and recommend instance or task roles. With no keys set, every S3 log write from

osctrl-tls

, and every read by `osctrl-api`'s S3 log reader, failed with

static credentials are empty

instead of falling back to the default AWS chain. That broke S3 logging on any deployment that relies on IAM roles. The S3 carver had the same bug and was fixed separately. Change •

CreateLoggerS3

adds the static credentials provider only when

accessKey

is set. Otherwise it uses `config.LoadDefaultConfig`'s default chain (environment variables, shared config/credentials files, IAM instance/task roles). •

CreateLoggerS3

now returns an error when only one of

accessKey

/

secretAccessKey

is set. Every caller goes through this function, so a half-configured pair is rejected everywhere: • TLS exporter construction (

pkg/logging/exporter_factory.go

) • API S3 log reader (

cmd/api/main.go

, already fatal on error) • Log-sink builds and reloads (

pkg/logsinks

) • Kinesis logger checked:

CreateLoggerKinesis

already adds static credentials only when keys or a session token are set, so it needs no change. Security / operational impact • Deployments that set both static keys behave exactly as before. • Deployments with no keys now authenticate through the default AWS chain, so IAM roles work as documented. • Deployments with only one key set now fail at startup, or when a log sink is saved, with a clear error. Before, they failed silently on every S3 call. Validation • New table-driven test

TestCreateLoggerS3UsesStaticKeysOnlyWhenConfigured

(

pkg/logging/s3_test.go

). It sets `AWS_ACCESS_KEY_ID`/`AWS_SECRET_ACCESS_KEY` and points `AWS_CONFIG_FILE`/`AWS_SHARED_CREDENTIALS_FILE` at a temp path, then checks: • no static keys →

Retrieve

returns the env credentials • both static keys → static credentials are used • only access key / only secret key → error • The test failed before the fix (

static credentials are empty

) and passes after it. •

go test ./...

,

go vet ./pkg/... ./cmd/...

,

gofmt -l pkg/logging

and

golangci-lint run ./pkg/logging/...

(0 issues) all pass. jmpsec/osctrl