Struggling with aws keys in the CLI using secret references in developer tools

Two suggestions:

First, it looks like your .config/op/aws-env/CRC2/.env file defines the environment variables access_key and secret_key. But the aws CLI requires them to be named AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY.

So your .env file should probably look like this:


AWS_ACCESS_KEY_ID=op://{{vault}}/{{item}}/access_key_id
AWS_SECRET_ACCESS_KEY=op://{{vault}}/{{item}}/secret_access_key


Second: if you're using op to inject credentials via environment variables, then you shouldn't need the --profile CRC2 switch. (That switch tells aws CLI to fetch credentials for the CRC2 profile from your ~/.aws/credentials file)

Two suggestions:

First, it looks like the environment variables in your ~/.config/op/aws-env/CRC2/.env file are named access_key and secret_key - but aws CLI requires them to be named AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY. So your environment file should look something like this:


AWS_ACCESS_KEY_ID=op://{{vault}}/{{item}}/access_key_id
AWS_SECRET_ACCESS_KEY=op://{{vault}}/{{item}}/secret_access_key


Second, you probably don't need the --profile CRC2 switch. That switch instructs aws CLI to get the credentials for the CRC2 profile from your ~/.aws/credentials file - which isn't necessary now that op is supplying the credentials via environment variables.

Thank you! I had wondered if --profile might somehow be to blame, but couldn't think of a mechanism that would make it work without it. And thank you for the tip about the var names--I had originally named them that, and changed as one debugging iteration when I noticed that in the output for "aws configure list --profile " returned the lowercase vars. I haven't gotten to test this yet but thanks for replying on a Saturday, and I hope you have a great weekend!

It's working! 🎉🎉🎉 Thanks so much for your help.

Hi @manach - it's great that @matthewf's advice was helpful here. Thank you @matthewf!

If you do have any further questions, let us know and we'll be happy to help. We're a bit busier than usual at the moment given the launch of 1Password 8 for Mac, but will nevertheless get back to you - if you don't hear from knowledgeable community members first. 😃