Make sure build-image works with AWS profiles

[rustyrazorblade]

I'm actually not sure how this would work, given build-image runs in a docker container.

[rustyrazorblade]

@claude

[claude]

Claude finished @rustyrazorblade's task in 5m 4s —— View job • claude/issue-448-20260312-1737 • Create PR ➔

---

AWS Profile Support for build-image

• Investigate build-image command implementation
• Understand how Docker container is invoked
• Research AWS profile passthrough options
• Modify AWSCredentialsManager to expose profile-based credential properties
• Modify Packer.kt to mount ~/.aws/ when using profiles
• Add AWS_PROFILE, AWS_CONFIG_FILE, AWS_CONFIG_DIR_MOUNT constants to Constants.kt
• Write tests for AWSCredentialsManager

How it works:

The build-image command runs Packer inside a Docker container. The challenge with AWS profiles is that profile config lives in ~/.aws/ on the host, which isn't accessible inside the container.

Solution: When awsProfile is set in the user config, mount the host ~/.aws/ directory read-only into the Packer container at /aws-config/, then set three environment variables so the AWS SDK inside Packer finds everything:

• AWS_SHARED_CREDENTIALS_FILE=/aws-config/credentials
• AWS_CONFIG_FILE=/aws-config/config
• AWS_PROFILE=<your-profile>

This handles static profiles, assume-role chains, and SSO (the SSO cache tokens in ~/.aws/sso/cache/ are included in the mount). When no profile is configured, it falls back to the existing access-key/secret credentials file approach.

Files changed:

• Constants.kt — added AWS_PROFILE_ENV, AWS_CONFIG_FILE_ENV, AWS_CONFIG_DIR_MOUNT
• AWSCredentialsManager.kt — added isProfileBased, profileName, hostAwsConfigDir properties
• Packer.kt — branch on profile vs key mode when setting up Docker credential volumes
• AWSCredentialsManagerTest.kt — new unit tests covering both modes

|