title: Access aws services without key & secret in php
body: <p>To be clear, We have created the EC2 policy, so my site can directly access the services like Parameter store, S3, Amazon SES etc.</p>
  <p>As of now, all of my credentials are stored on AWS Parameter Store and then site is using those credentials i.e. DB credentials, diff. API keys etc. So only hard coded credentials are the one which fetch the parameters from Parameter Store. Now client want to remove those hard coded credentials as well, that's why we have created the EC2 Policy.</p>
  <p>Till now, we have code like below to fetch the parameters:</p>
  <pre><code>$config = array(
          'version' =&gt; 'latest',
          'region' =&gt; '*****',
          'credentials' =&gt; array(
              'key' =&gt; '*******',
              'secret' =&gt; '******',
          )
      );
  $s3_instance = new \Aws\Ssm\SsmClient($config);
  
  $result = $s3_instance-&gt;getParameters([
      'Names' =&gt; $credential_group,
      'WithDecryption' =&gt; true
  ]);
  //converting S3 private data to array to read
  $keys = $result-&gt;toArray();
  var_dump($keys);
  </code></pre>
  <p>Now the question is what i have to change in above code, so it should work without passing those credentials.</p>
  <p>Note: I am using AWS PHP library to perform above.</p>
  <h1>Update</h1>
  <p>Further reading the documentation, <a href="https://docs.aws.amazon.com/sdk-for-php/v3/developer-guide/guide_credentials.html" rel="nofollow noreferrer">https://docs.aws.amazon.com/sdk-for-php/v3/developer-guide/guide_credentials.html</a></p>
  <blockquote>
  <p>Using Credentials from Environment Variables<br />
  If you don't provide credentials to a client object at the time of its instantiation, the SDK attempts to find credentials in your environment. The first place the SDK checks for credentials is in your environment variables. The SDK uses the getenv() function function to look for the AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY, and AWS_SESSION_TOKEN environment variables. These credentials are referred to as environment credentials.</p>
  </blockquote>
  <p>So after that, i have tried the below:</p>
  <blockquote>
  <p>var_dump(getenv('AWS_ACCESS_KEY_ID'));</p>
  </blockquote>
  <p>But it returns the bool(false). So does i need to manually setup those in environment credentials?<br />
  Which things i need to change in above code?</p>
  <h1>Update</h1>
  <p>Based on this doc: <a href="https://docs.aws.amazon.com/sdk-for-php/v3/developer-guide/guide_configuration.html#credentials" rel="nofollow noreferrer">https://docs.aws.amazon.com/sdk-for-php/v3/developer-guide/guide_configuration.html#credentials</a></p>
  <p>I had made below change (Removed the credentials part from array):</p>
  <pre><code>$config = array(
      'version' =&gt; 'latest',
      'region' =&gt; '*****'
  );
  </code></pre>
  <p>Then system throws the below warnings:</p>
  <blockquote>
  <p>Warning: include(Test_Role_Cognitoaccess_from_instanceRole.php): failed to open stream</p>
  <p>Warning: include(): Failed opening 'Test_Role_Cognitoaccess_from_instanceRole.php' for inclusion (include_path='.:/usr/share/pear:/usr/share/php')</p>
  <p>Warning: include(Test_Role_Cognitoaccess_from_instanceRole.php): failed to open stream</p>
  <p>Warning: include(): Failed opening 'Test_Role_Cognitoaccess_from_instanceRole.php' for inclusion (include_path='.:/usr/share/pear:/usr/share/php')</p>
  </blockquote>