87

I am trying to send SNS messeges to android through web api. Downloaded and installed the SDK from http://aws.amazon.com/developers/getting-started/php/

Got following error while running sample.php:

Fatal error: Uncaught exception 'Aws\Common\Exception\InstanceProfileCredentialsException' with message 'Error retrieving credentials from the instance profile metadata server. When you are not running inside of Amazon EC2, you must provide your AWS access key ID and secret access key in the "key" and "secret" options when creating a client or provide an instantiated Aws\Common\Credentials\CredentialsInterface object. ([curl] 28: Connection timed out after 5016 milliseconds [url] http://169.254.169.254/latest/meta-data/iam/security-credentials/)' in C:\xampp\htdocs\aws-php\vendor\aws\aws-sdk-php\src\Aws\Common\InstanceMetadata\InstanceMetadataClient.php:85 Stack trace: #0 C:\xampp\htdocs\aws-php\vendor\aws\aws-sdk-php\src\Aws\Common\Credentials\RefreshableInstanceProfileCredentials.php(52): Aws\Common\InstanceMetadata\InstanceMetadataClient->getInstanceProfileCredentials() #1 C:\xampp\htdocs\aws-php\vendor\aws\aws-sdk-php\src\Aws\Common\Credentials\AbstractRefreshableCredentials.php(54): Aws\Common\Credentials\Refreshable in C:\xampp\htdocs\aws-php\vendor\aws\aws-sdk-php\src\Aws\Common\InstanceMetadata\InstanceMetadataClient.php on line 85

A little guidance on this topic will help me a lot

6
  • 2
    This means that you have not configured your credentials correctly. Please see Providing Credentials to the SDK from the AWS SDK for PHP User Guide. Dec 10, 2014 at 19:16
  • 1
    I already configured the /.aws/credentials file with AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY as mentioned here. Still it's not working
    – Ravindra
    Dec 11, 2014 at 7:28
  • @JeremyLindblom I'm seriously struggling with the documentation on creating this one file. I am running an EC2 instance and via Putty attempted sudo nano ~/.aws/credentials, sudo mkdir /.aws + cd /.aws + sudo nano credentials - nothing wants to work and there's little information on the web. Any ideas?
    – J Young
    Apr 18, 2015 at 11:02
  • Credential files are best used for local development environments. I would use IAM role credentials on EC2: web.archive.org/web/20150412020424/http://docs.aws.amazon.com/… Apr 20, 2015 at 20:45
  • 1
    The issue, though, is that your HOME may not be where you think it is when you are running PHP (i.e., see what getenv('HOME') returns in your app). You may need to move the file or call Credentials::fromIni() directly as a workaround. (However, like I said in the last comment, you should use IAM role credentials if you are hosted on EC2.) Apr 20, 2015 at 20:50

10 Answers 10

176

In my case, I was using

return DynamoDbClient::factory(array(
  'version' => 'latest',
  'region'  => AWS_REGION,
  'key' => AWS_KEY,
  'secret'  => AWS_SECRET
));

which used to be ok with aws/aws-sdk-php version 2.8.5 , but when composer automatically installed version 3.2.0, I got the error above. The problem is simply that I should've changed the way I made the call to

return DynamoDbClient::factory(array(
  'version' => 'latest',
  'region'  => AWS_REGION,
  'credentials' => array(
    'key' => AWS_KEY,
    'secret'  => AWS_SECRET,
  )
));

as documented here. Without changing the call, the apache php was falling back to looking for the ~/.aws/credentials file using the HOME environment variable, which was empty. You can check its value by running php -r 'var_dump(getenv("HOME"));'.

This is a related post

4
  • 11
    This saved me a huge headache.
    – vcardillo
    Aug 27, 2015 at 23:29
  • 4
    Wow, they managed to leave this incredibly important detail out of their SES guides... Thank you Jul 12, 2016 at 22:13
  • Ah - I see. Thats why it worked from the cli with my login, but not another! Jan 29, 2019 at 1:05
  • Same solution if you use async-aws instead of aws sdk Aug 8, 2022 at 15:40
33

In my case I had to use hard-coded credentials

$s3Client = new S3Client([
    'region' => REGION,
    'version' => '2006-03-01',
    'credentials' => [
        'key'    => S3_KEY,
        'secret' => S3_SECRETE,
    ],
]);

See more details here:

1
  • I was not understand before how to pass credentials, and here is your answer, thanks. Feb 7 at 6:44
12

You have to place the .aws/credentials file with your configuration in the home directory of the web service *usually /var/www) not in the home directory of the logged in user.

You can find what home directory you web service is using by running echo getenv('HOME'); in a php file on your server.

3
  • 1
    echo getenv('HOME'); return null to me using Docker php apache instance :(
    – GusDeCooL
    Aug 21, 2020 at 3:20
  • make sure you don't just symlink it... needs to actually exist there in my case.
    – wowo_999
    Jan 31, 2022 at 18:56
  • its still shows null even i not use docker and not symlink it
    – Lezir Opav
    Jul 6, 2022 at 9:01
9

I was trying to use a credentials file and got the same error, this guy on github pretty much nailed it:

The credentials file should be in ini format but not have a .ini extension. It should have a 'default' section defined with your key and secret:

$ less ~/.aws/credentials

[default]
aws_access_key_id = key
aws_secret_access_key = secret

If you specified other section name instead of default, just add a profile key to the S3Client parameters:

[example]
aws_access_key_id = key
aws_secret_access_key = secret

$s3Client = new \Aws\S3\S3Client([
    'version' => '2006-03-01',
    'region' => $yourPreferredRegion,
    'profile' => 'example',
]);

Using a credentials file or environment variables is the recommended way of providing credentials on your own server

And @Anti 's answer also helped me alot!

If you prefer the hard coded way, just follow @shadi 's answer.

6

If it is laravel and aws/aws-sdk-php-laravel sdk then after configuring all step and defining key in .env file you have to drop config cache and rebuild it by following commands.

php artisan config:cache;
composer dump-autoload;
6

assuming that the server is located on AWS EC2 (probably the same for ECS and elastic beanstalk) the "correct" way to handle this issue is not to store credentials at all.

instead, do this:

  1. create an IAM role (https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/iam-roles-for-amazon-ec2.html)
  2. add relevant permissions to the role policy (in this case, send SNS msg)
  3. assign the role to the EC2 instance (instance settings => Attach/Replace IAM Role)

this way you don't leave any sensitive data in your code.

1
  • This is the right way to go if your server/code is on AWS.
    – dAngelov
    Oct 17, 2022 at 14:43
4

Here are the steps:

  1. Type cd ~ By this you will go into the home directory.
  2. mkdir .aws
  3. sudo vi .aws/credentials
  4. Write following lines and save the file.

    [default]
    aws_access_key_id = Your AWS Access Key
    
    aws_secret_access_key = Your AWS Secret Access Key
    
2
  • 1
    This works great if you're trying to use the AWS SDK in command-line scripts.
    – apokryfos
    May 10, 2017 at 10:37
  • 1
    To save and exit vi - Hit esc and type :wq and then hit enter. Or if you made a mistake while typing. To exit without saving vi - Hit esc and type :q! and then hit enter. Apr 24, 2019 at 6:28
2

This might be because the config file hasn't been published.

Be sure to publish the config file:

php artisan vendor:publish  --provider="Aws\Laravel\AwsServiceProvider"

To test this is the issue, just clear the config.

php artisan config:clear

If it works with the cache cleared, then this will be the issue.

0
0

In my case (laravel 8, right after a few version upgrades) i had to change the "scripts" part of composer.json. Then after a "sail composer install" my AWS code worked again.

"scripts": {
    "post-autoload-dump": [
        "Illuminate\\Foundation\\ComposerScripts::postAutoloadDump",
        "@php artisan package:discover --ansi"
    ],
    "post-update-cmd": [
        "@php artisan vendor:publish --tag=laravel-assets --ansi --force"
    ],
    "post-root-package-install": [
        "@php -r \"file_exists('.env') || copy('.env.example', '.env');\""
    ],
    "post-create-project-cmd": [
        "@php artisan key:generate --ansi"
    ]
},

Source: https://github.com/laravel/laravel/blob/8.x/composer.json

-1

You can try these lines:

$credentials = new Aws\Credentials\Credentials('key' , 'secret-key');

$s3 = new S3Client(['version' => 'latest','region' => 'ap-south-1','credentials'=>$credentials]);

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.