Make AWS S3 Credentials Optional when running Craft on AWS EC2/ECS.

[vanburenx]

I'm submitting a...

• bug report
• feature request
• general question

Description

Remove the need for AWS accessKey/secretAccessKey credentials if you're running on AWS EC2/ECS and instead use Assumed Roles (instance profile credentials). This removes the need to create/manage additional/unnecessary credentials.

AWS Docs

Creating OpenID Connect (OIDC) identity providers

https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_providers_create_oidc.html

Using IAM roles for Amazon EC2 instance variable credentials

https://docs.aws.amazon.com/sdk-for-php/v3/developer-guide/guide_credentials_assume_role.html

Task IAM role

https://docs.aws.amazon.com/AmazonECS/latest/developerguide/task-iam-roles.html

Craft CMS S3 implementation

Assuming Role with OpenID Connect (OIDC) (craftcms/aws-s3)

https://github.com/craftcms/aws-s3#assuming-role-with-oidc

Tasks running in ECS (craftcms/aws-s3)

https://github.com/craftcms/aws-s3?tab=readme-ov-file#tasks-running-in-ecs

Code used for craftcms/aws-s3

https://github.com/craftcms/aws-s3/blob/a04ee659490d53da879e302e660ba3807532a926/src/Fs.php#L423

Credential-less auth should be explicit opt-in (craftcms/aws-s3)

craftcms/aws-s3#155

Additional info

• Imager version & edition: 4.2.4 (PRO)
• Imager transformer: Craft
• Craft version: 4.7.2.1
• PHP version: 8.0.30
• Image driver & version: Imagick (ImageMagick 7.1.1-28)