Repository: aws/aws-sdk-rails (Ruby)

Issue:
Rails.application.credentials.aws reserved for aws credentials 👎
Recently in our application that uses this gem, we migrated from previous `Rails.secrets` mechanism to the new `Rails.application.credentials`. Unfortunately, after moving the same keys from `config/secrets.yml.enc` to new encrypted credentials we saw an error about `invalid configuration option: ':rds_instance'`, which we stored under `Rails.application.credentials.aws`.

I tried to look in `aws-sdk-ruby` for code that automatically loads these credentials. With no luck there, I assumed it was Rails itself that's responsible. I was very happy to see that [this was not the case](https://github.com/rails/rails/issues/38754#issuecomment-602276489).

Reserving keys in the standard credentials mechanism is bad for many reasons::
1. It's magic and unexpected
2. Was not present in previous `Rails.application.secrets` making the migration difficult
3. This `invalid configuration option` error is difficult to debug (validation happens late in a different gem and `aws-sdk-rails` does not appear in the stack trace)
4. Most importantly, if more gems would start reserving their own keys in `Rails.application.credentials`, it would be a mess

I would want to call for this behavior to be deprecated and eventually removed from defaults.


Discussion:
I've been looking into this and agree that the current process of loading all values under the `aws` namespace in the Rails Encrypted Credentials is a bad practice.  I've created a PR to address this: #33.  This change prevents the "aws" namespace from being "reserved" while still allowing users of this gem to have their aws credentials loaded.  



Patch:
diff --git a/.travis.yml b/.travis.yml
index 48ce9be0..3a57dd5c 100644
--- a/.travis.yml
+++ b/.travis.yml
@@ -5,6 +5,7 @@ rvm:
   - 2.4
   - 2.5
   - 2.6
+  - 2.7
   - jruby
 
 gemfile:
diff --git a/CHANGELOG.md b/CHANGELOG.md
index 7dff7849..534e21c5 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,5 +1,7 @@
 Unreleased Changes
 ------------------
+* Issue - Merge only credential related keys from Rails encrypted credentials
+into `Aws.config`.
 
 3.0.5 (2019-10-17)
 ------------------
diff --git a/lib/aws-sdk-rails.rb b/lib/aws-sdk-rails.rb
index 72a9ea06..8de619a4 100644
--- a/lib/aws-sdk-rails.rb
+++ b/lib/aws-sdk-rails.rb
@@ -37,7 +37,15 @@ def self.log_to_rails_logger
 
     # Configures the AWS SDK with credentials from Rails encrypted credentials.
     def self.use_rails_encrypted_credentials
-      Aws.config.merge!(::Rails.application.try(:credentials).try(:aws).to_h)
+      # limit the config keys we merge to credentials only
+      aws_credential_keys = %i[access_key_id secret_access_key session_token]
+
+      Aws.config.merge!(
+        ::Rails.application
+          .try(:credentials)
+          .try(:aws)
+          .to_h.slice(*aws_credential_keys)
+      )
     end
   end
 end


Test patch:
diff --git a/test/aws/rails/railtie_test.rb b/test/aws/rails/railtie_test.rb
index 0589282c..9bcc54df 100644
--- a/test/aws/rails/railtie_test.rb
+++ b/test/aws/rails/railtie_test.rb
@@ -18,6 +18,9 @@ def test_use_rails_encrypted_credentials
         creds = ::Rails.application.credentials.aws
         assert_equal Aws.config[:access_key_id], creds[:access_key_id]
         assert_equal Aws.config[:secret_access_key], creds[:secret_access_key]
+
+        refute_nil creds[:non_credential_key]
+        assert_nil Aws.config[:non_credential_key]
       end
     end
   end
diff --git a/test/dummy/config/credentials.yml.enc b/test/dummy/config/credentials.yml.enc
index 8d73a8f1..c94a2899 100644
--- a/test/dummy/config/credentials.yml.enc
+++ b/test/dummy/config/credentials.yml.enc
@@ -1,1 +1,1 @@
-MuaBTAE++TBPtxSwdsNOHYmVgHtbXMAt6XcwLUEEg+o5p4uKtFn0YpeUlfV4GrYiY01GJFjWj0RPDA9zLERlj9S8wjUgS+v2l/E5WCe799QyUYjIIwjHsnhtZJG6EdY89ZqvnaUFMq2y+YT7c8EQHqdHg5B/85FZ9Onu5VBDrDCOqGnAocvugDOm7XIZ2xEoVwZAWOpEh0QOyXA1ZJbhhYi/Vnf+wR0A0Kc5GcSaGVI3YB9plOBRp3k6IUa0773+ccqbtuSs1O3lqyWwM/43AGABiHUGOUKNLHpNQ/cdmBIXa8sdWCe8gS1SNyZbkVVtDepqDfGjU7SxeowlN7zyNhVuKz8Jx2ahQ3i2Q+qU9L5kk8PvM4tRFe2O5rpwMxSt+aUFY73nmtE0yYvygn8K--Xr/N649un+QSGKLe--c0sUqfbkVBSkhWb4E6cl6g==
\ No newline at end of file
+9Q4/CZUnHMrnOYeWTA7kSq7AtsuAMMVRmq+7TKvitpHrDGP1Lo7u4K6LbL4sZ6h2jwt3fl7fhoJ/jB6h6pSEqj7nyfO3AZ1gL24CWkr/FL1tqei1/2mWqhiIlavZEJFtYWsyXyn0RlnrPB38SWF8JhaDsfCuS948eeWu1EOJIL8UiOLiB9U50MK6MJ9IaaPmu5xOkbJff9NTR0XUcX45C3RmFEClfMJRDV/vJ2XQGsZpFhiG4nMn69pd4KIbWbhBxJn3tWZ6vpleY3/TeOQkp3jxJHRdzsNl336COqDJapZu0G5uFaLUp1sg647i5ERXjLC/jvD/XUqbfFgTKQQh/6CNJWBmn7leSzn6mQyd1pkivSbjNw5CgbolP0Urzhro1JagGVIGKSbxlH9GVB8VcBbBUHCVI2d9XJet5rt4hWvYCZUoM888iLXTAwl8cqJXjV+b--zqbhQIodcWc8SqQR--AzEDGPY72mDsAAcz1rb+Gw==
\ No newline at end of file