Announcement: Upcoming credential resolution change

[sichanyoo]

Announcement

On 7/16/2025, Wednesday, AWS SDK for Swift will change its credential resolution order in the ProfileAWSCredentialIdentityResolver chain and the DefaultChainAWSCredentialIdentityResolver. The changes outlined below will be released with a minor version bump. If your environment has credentials configured in multiple ways, changes described below may cause your application to start to resolve credentials from different places than before.

Please see below for more details:

ProfileAWSCredentialIdentityResolver change

The order of sources looked at for credentials in ProfileAWSCredentialIdentityResolver will change as outlined below:

Currently:

1. Profile: assume role with source profile
2. Profile: assume role with named provider / credential_source
3. Profile: process
4. Profile: shared credentials file (static credentials under a profile)

Will be changed to:

1. Profile: shared credentials file (static credentials under a profile)
2. Profile: assume role with source profile
3. Profile: assume role with named provider / credential_source
4. Profile: web identity token / STS
5. Profile: SSO role credentials
6. Profile: legacy SSO
7. Profile: process

DefaultAWSCredentialIdentityResolver change

The order of sources looked at for credentials in DefaultAWSCredentialIdentityResolver will change as outlined below:

Currently:

1. Environment variables: credentials
2. Profile chain:
   a. Profile: assume role with source profile
   b. Profile: assume role with named provider / credential_source
   c. Profile: process
   d. Profile: shared credentials file
3. STS Web Identity:
   a. Environment variables: web identity token / STS
   b. Profile: web identity token / STS
4. ECS credentials resolver (aka HTTP / Container / EKS resolver)
5. IMDS / EC2

Not part of default chain:

• Profile: SSO role credentials
• Profile: legacy SSO

Will be changed to:

1. Environment variables: credentials
2. Environment variables: web identity token / STS
3. Profile chain:
   a. Profile: shared credentials file
   b. Profile: assume role with source profile
   c. Profile: assume role with named provider / credential_source
   d. Profile: web identity token / STS
   e. Profile: SSO role credentials
   f. Profile: legacy SSO
   g. Profile: process
4. ECS credentials resolver (aka HTTP / Container / EKS resolver)
5. IMDS / EC2

Reason this change

Having a standard credential resolution order among SDKs & AWS CLI is very important because it allows seamless transition between the tools where credentials continue to get resolved from the same place regardless of the tool used. This change allows AWS SDK for Swift to be in sync with the current cross-SDK standard for credential resolution.

[sichanyoo]

The release date for the above change has been changed to 7/15/25 due to unexpected change in release schedule.

[sichanyoo]

This is delayed again for now, this post will be updated once date gets finalized.

[sichanyoo]

This change was released today (7/16/25) with v1.5.0: https://github.com/awslabs/aws-sdk-swift/releases/tag/1.5.0