Init hooks: Remove default AWS credentials (#11705)

viren-nadkarni · web-flow · commit a60da92fd75f · 2024-11-12T15:40:41.000+05:30
diff --git a/localstack-core/localstack/runtime/init.py b/localstack-core/localstack/runtime/init.py
@@ -11,7 +11,6 @@
 
 from plux import Plugin, PluginManager
 
-from localstack import constants
 from localstack.runtime import hooks
 from localstack.utils.objects import singleton_factory
 
@@ -156,12 +155,7 @@ def run_stage(self, stage: Stage) -> List[Script]:
             for script in scripts:
                 LOG.debug("Running %s script %s", script.stage, script.path)
 
-                # Deprecated: To be removed in v4.0 major release.
-                # Explicit AWS credentials and region will need to be set in the script.
                 env_original = os.environ.copy()
-                os.environ["AWS_ACCESS_KEY_ID"] = constants.DEFAULT_AWS_ACCOUNT_ID
-                os.environ["AWS_SECRET_ACCESS_KEY"] = constants.INTERNAL_AWS_SECRET_ACCESS_KEY
-                os.environ["AWS_REGION"] = constants.AWS_REGION_US_EAST_1
 
                 try:
                     script.state = State.RUNNING
@@ -176,13 +170,19 @@ def run_stage(self, stage: Stage) -> List[Script]:
                 else:
                     script.state = State.SUCCESSFUL
                 finally:
-                    # Restore original state of Boto credentials.
-                    for env_var in ("AWS_ACCESS_KEY_ID", "AWS_SECRET_ACCESS_KEY", "AWS_REGION"):
+                    # Discard env variables overridden in startup script that may cause side-effects
+                    for env_var in (
+                        "AWS_ACCESS_KEY_ID",
+                        "AWS_SECRET_ACCESS_KEY",
+                        "AWS_SESSION_TOKEN",
+                        "AWS_DEFAULT_REGION",
+                        "AWS_PROFILE",
+                        "AWS_REGION",
+                    ):
                         if env_var in env_original:
                             os.environ[env_var] = env_original[env_var]
                         else:
                             os.environ.pop(env_var, None)
-
         finally:
             self.stage_completed[stage] = True
 
