Fix default profile handling when parsing AWS configuration files

src/utilities/credentials.jl

@@ -36,11 +36,14 @@ function _get_ini_value(
 end
 
 function _aws_profile_config(ini::Inifile, profile::AbstractString)
-    if profile != "default" || !haskey(sections(ini), "default")
-        profile = "profile $profile"
+    # Prefer using "profile default" over "default"
+    section_name = if profile != "default" || haskey(sections(ini), "profile default")
+        "profile $profile"
+    else
+        "default"
     end
 
-    return get(sections(ini), profile, Dict())
+    return copy(get(sections(ini), section_name, IniFile.HTSS()))
 end
 
 function _aws_profile_config(ini::Inifile, profile::Nothing)

test/AWSCredentials.jl

@@ -213,7 +213,6 @@ end
             """
             [profile test]
             output = json
-            region = us-east-1
 
             [profile test:dev]
             source_profile = test
@@ -226,8 +225,6 @@ end
             [profile test2]
             aws_access_key_id = WRONG_ACCESS_ID
             aws_secret_access_key = WRONG_ACCESS_KEY
-            output = json
-            region = us-east-1
 
             [profile test3]
             source_profile = test:dev
@@ -264,6 +261,7 @@ end
             "AWS_DEFAULT_PROFILE" => "test",
             "AWS_PROFILE" => nothing,
             "AWS_ACCESS_KEY_ID" => nothing,
+            "AWS_REGION" => "us-east-1",
         ) do
             @testset "Loading" begin
                 # Check credentials load

test/runtests.jl

@@ -23,7 +23,7 @@ using Dates
 using Downloads
 using GitHub
 using HTTP
-using IniFile: Inifile
+using IniFile: Inifile, sections
 using JSON
 using OrderedCollections: LittleDict, OrderedDict
 using MbedTLS: digest, MD_SHA256, MD_MD5
@@ -66,6 +66,7 @@ const AWS_CONFIG = Ref{AbstractAWSConfig}()
     @testset "Unit Tests" begin
         if RUN_UNIT_TESTS
             include("unit/AWS.jl")
+            include("unit/AWSCredentials.jl")
         else
             @warn "Skipping unit tests"
         end

test/unit/AWSCredentials.jl

@@ -0,0 +1,63 @@
+@testset "_aws_profile_config" begin
+    using AWS: _aws_profile_config
+
+    @testset "access" begin
+        #! format: off
+        buffer = IOBuffer(
+            """
+            [profile A]
+            output = json
+            region = us-east-1
+
+            [profile B]
+            role_arn = arn:aws:iam::123456789000:role/A
+            source_profile = A
+            """
+        )
+        #! format: on
+        ini = Inifile()
+        read(ini, buffer)
+
+        # Retrieve fields from profile "A"
+        config = _aws_profile_config(ini, "A")
+        @test keys(config) ⊆ Set(["output", "region"])
+        @test config["output"] == "json"
+        @test config["region"] == "us-east-1"
+
+        # Ensure that mutating the returned dictionary does not mutated the contents of the
+        # `ini`
+        config["output"] = "yaml-stream"
+        section = sections(ini)["profile A"]
+        @test section["output"] == "json"
+
+        # Use of `source_profile` does not inherit properties from the source. This mirrors
+        # the AWS CLI (version v2.27.15) behavior for `region` which can be seen using
+        # `aws configure list --profile X`
+        config = _aws_profile_config(ini, "B")
+        @test keys(config) ⊆ Set(["role_arn", "source_profile"])
+        @test config["role_arn"] == "arn:aws:iam::123456789000:role/A"
+        @test config["source_profile"] == "A"
+    end
+
+    # AWS CLI (version v2.27.15) will use "profile default" over "default" when both are
+    # defined within the configuration. This is true when `AWS_PROFILE` is unset or
+    # `AWS_PROFILE="default".
+    @testset "default profile" begin
+        #! format: off
+        buffer = IOBuffer(
+            """
+            [default]
+            region = default-1
+
+            [profile default]
+            region = default-2
+            """
+        )
+        #! format: on
+        ini = Inifile()
+        read(ini, buffer)
+
+        config = _aws_profile_config(ini, "default")
+        @test config["region"] == "default-2"
+    end
+end