newrelic-platform/newrelic_aws_cloudwatch_plugin — pull request #35 by rjocoleman (2014-03-15 02:01:08+00:00)
Title: remove premature check for valid AWS credentials

This PR makes specifying AWS credentials and region optional as the AWS SDK provides a number of other options that are preferable in many cases .

AWS supports transparently and securely granting credentials to EC2 instances via IAM Roles and Instances Profiles.
A role can be created granted permissions to access the needed AWS resources. When the monitoring instance is created it is assigned the new role. The credentials (access_key, secret_key) to use are provided to the instance transparently via the instance metadata service. These credentials are automatically cycled several times a day.

The AWS SDK handles multiple levels of providing credentials, those that are directly specific like the current behaviour of this gem, if not present then it falls to some specific ENV and if they're not present it looks at the instance profile in the instance's metadata.

As such, with this change, this 'plugin' now supports obtaining it's credentials via `ENV['AWS_ACCESS_KEY_ID']` and `ENV['AWS_SECRET_ACCESS_KEY']` and IAM roles.

This means that a user could start up an instance, (or the AMI) and only provide the New Relic license key they would not have to hard code credentials anywhere.

http://aws.typepad.com/aws/2012/06/iam-roles-for-ec2-instances-simplified-secure-access-to-aws-service-apis-from-ec2.html
http://docs.aws.amazon.com/AWSSdkDocsRuby/latest/DeveloperGuide/ruby-dg-roles.html
http://docs.aws.amazon.com/IAM/latest/UserGuide/role-usecase-ec2app.html

Now if no credentials are present instead of NewRelic::Plugin::BadConfig an error from aws-sdk is shown:
```
[2014-03-15 01:48:23 UTC] DEBUG: ############## start poll_cycle ############
[2014-03-15 01:48:24 UTC] ERROR: Error occurred in poll cycle:
Missing Credentials.

Unable to find AWS credentials. You can configure your AWS credentials
a few different ways:

* Call AWS.config with :access_key_id and :secret_access_key

* Export AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY to ENV

* On EC2 you can run instances with an IAM instance profile and credentials
will be auto loaded from the instance metadata service on those
instances.

* Call AWS.config with :credential_provider. A credential provider should
either include AWS::Core::CredentialProviders::Provider or respond to
the same public methods.

= Ruby on Rails

In a Ruby on Rails application you may also specify your credentials in
the following ways:

* Via a config initializer script using any of the methods mentioned above
(e.g. RAILS_ROOT/config/initializers/aws-sdk.rb).

* Via a yaml configuration file located at RAILS_ROOT/config/aws.yml.
This file should be formated like the default RAILS_ROOT/config/database.yml
file.

```

This comes from `newrelic_plugin` and could be rescued/raised more appropriately there.