S3 client does not use default chain?

[JohnPreston]

What happened?

I am not running my LibreChat on K8s/EKS, yet I have provided the env var AWS_SHARED_CREDENTIALS_FILE which feeds the credentials.

All SDKs would normally pick up on that as per the Credentials Provider Chain.

We should not be forced to give the access and secret keys, especially when using IAM roles which would have assumed creds, which require to also include the secret token.

Version Information

ghcr.io/danny-avila/librechat latest fdaddca5d75c 2 weeks ago 1.57GB

Steps to Reproduce

in the compose file, have a path to a valid aws credentials/profile config file. Expose it via env var.

See https://docs.aws.amazon.com/cli/latest/topic/config-vars.html#the-shared-credentials-file

services:
  librechat:
    environment:
      AWS_SHARED_CREDENTIALS_FILE: /_aws/creds/config
      AWS_BUCKET_NAME: my-librechat-bucket
      AWS_REGION: eu-west-1

What browsers are you seeing the problem on?

Firefox

Relevant log output

librechat-1  | 2025-09-12 09:23:55 info: [initializeS3] S3 initialized using default credentials (IRSA).

It did not detect that we are not using IRSA

Screenshots

No response

Code of Conduct

• I agree to follow this project's Code of Conduct

[danny-avila]

It should be possible via IRSA, but I think would need to be implemented for the credentials file

https://www.librechat.ai/docs/configuration/cdn/s3

[JohnPreston]

Well, the docs there speak of EKS which uses that OIDC based provider, which does not work outside of EKS.
I don't have the skillset to make a PR in this https://github.com/danny-avila/LibreChat/blob/5b5723343c05f26a8d32a663292b23bcd0dbc59f/api/server/services/Files/S3/initialize.js But I might try.

The point is that the AWS SDK would automatically pick the credentials from the chain instead of having to feed it all these details, which significantly makes things easier for users.

[JohnPreston]

PS by default chain I mean

https://docs.aws.amazon.com/sdkref/latest/guide/standardized-credentials.html#credentialProviderChain