AWS credentials in shell environment overwrites backupSettings.json
HoukasaurusRex opened this issue · 0 comments
HoukasaurusRex commented
Description
When invoking grafana-backup in a shell environment that currently has AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY loaded by default, these will overwrite the key and secret set in the config file.
Expected Behaviour
I think it makes more sense to use the keys in backupSettings.json if provided and default to using AWS credentials in the environment if not provided.
The workaround for running on an aws lambda otherwise is setting the env vars in the current runtime before invoking like:
import os
import json
from grafana_backup.save import main as save
from grafana_backup.grafanaSettings import main as conf
from config import grafana_config
def handler(event = {}, context = {}):
grafana_backup_settings = grafana_config['grafana_backup_settings']
# Set env vars with vars in settings
os.environ['AWS_ACCESS_KEY_ID'] = grafana_backup_settings['aws']['access_key_id']
os.environ['AWS_SECRET_ACCESS_KEY'] = grafana_backup_settings['aws']['secret_access_key']
config_dir = grafana_config['config_dir']
grafana_backup_settings_filepath = os.path.abspath(os.path.join(config_dir, 'grafana-backup.json'))
grafana_backup_settings_json = json.dumps(grafana_backup_settings, indent=4)
if not os.path.exists(config_dir):
os.makedirs(config_dir)
with open(grafana_backup_settings_filepath, 'w') as grafana_backup_file:
grafana_backup_file.write(grafana_backup_settings_json)
settings = conf(grafana_backup_settings_filepath)
save({}, settings)
return {
'success': True
}
Which is not ideal for environments that rely on the reserved AWS credential environment variables for things like deployments as is the case with AWS lambda