SQS Transport to accept EC2-Profile as Credentials Source

src/ServiceControl.Transports.AmazonSQS/QueueLengthProvider.cs

@@ -6,6 +6,7 @@
     using System.Linq;
     using System.Threading;
     using System.Threading.Tasks;
+    using Amazon.Runtime;
     using Amazon.SQS;
     using Monitoring;
     using Monitoring.Infrastructure;
@@ -24,11 +25,23 @@ public class QueueLengthProvider : IProvideQueueLength
         string queueNamePrefix;
         CancellationTokenSource stop = new CancellationTokenSource();
         Task pooler;
+        Func<IAmazonSQS> clientFactory = () => new AmazonSQSClient();
 
 
         public void Initialize(string connectionString, QueueLengthStore store)
         {
             var builder = new DbConnectionStringBuilder { ConnectionString = connectionString };
+            if (builder.ContainsKey("AccessKeyId") || builder.ContainsKey("SecretAccessKey"))
+            {
+                // if the user provided the access key and secret access key they should always be loaded from environment credentials
+                clientFactory = () => new AmazonSQSClient(new EnvironmentVariablesAWSCredentials());
+            }
+            else
+            {
+                //See https://docs.aws.amazon.com/sdk-for-net/v3/developer-guide/net-dg-config-creds.html#creds-assign
+                Logger.Info("BasicAWSCredentials have not been supplied in the connection string. Attempting to use existing environment or IAM role credentials.");
+            }
+
             if (builder.TryGetValue("QueueNamePrefix", out var prefix))
             {
                 queueNamePrefix = (string)prefix;
@@ -66,7 +79,7 @@ public Task Start()
 
             pooler = Task.Run(async () =>
             {
-                using (var client = new AmazonSQSClient())
+                using (var client = clientFactory())
                 {
                     var cache = new QueueAttributesRequestCache(client);
 

src/ServiceControl.Transports.AmazonSQS/ServiceControlSqsTransport.cs

@@ -5,7 +5,10 @@ namespace ServiceControl.Transports.AmazonSQS
     using System.Linq;
     using System.Reflection;
     using Amazon;
+    using Amazon.Runtime;
+    using Amazon.SQS;
     using NServiceBus;
+    using NServiceBus.Logging;
     using NServiceBus.Settings;
     using NServiceBus.Transport;
 
@@ -15,8 +18,21 @@ public override TransportInfrastructure Initialize(SettingsHolder settings, stri
         {
             var builder = new DbConnectionStringBuilder { ConnectionString = connectionString };
 
-            PromoteEnvironmentVariableFromConnectionString(builder, "AccessKeyId", "AWS_ACCESS_KEY_ID");
-            PromoteEnvironmentVariableFromConnectionString(builder, "SecretAccessKey", "AWS_SECRET_ACCESS_KEY");
+            if (builder.ContainsKey("AccessKeyId") || builder.ContainsKey("SecretAccessKey"))
+            {
+                PromoteEnvironmentVariableFromConnectionString(builder, "AccessKeyId", "AWS_ACCESS_KEY_ID");
+                PromoteEnvironmentVariableFromConnectionString(builder, "SecretAccessKey", "AWS_SECRET_ACCESS_KEY");
+
+                // if the user provided the access key and secret access key they should always be loaded from environment credentials
+                var transport = new TransportExtensions<SqsTransport>(settings);
+                transport.ClientFactory(() => new AmazonSQSClient(new EnvironmentVariablesAWSCredentials()));
+            }
+            else
+            {
+                //See https://docs.aws.amazon.com/sdk-for-net/v3/developer-guide/net-dg-config-creds.html#creds-assign
+                log.Info("BasicAWSCredentials have not been supplied in the connection string. Attempting to use existing environment or IAM role credentials.");
+            }
+
             var region = PromoteEnvironmentVariableFromConnectionString(builder, "Region", "AWS_REGION");
 
             var awsRegion = RegionEndpoint.EnumerableAllRegions
@@ -62,5 +78,7 @@ static string PromoteEnvironmentVariableFromConnectionString(DbConnectionStringB
 
             throw new ArgumentException($"Missing value for '{connectionStringKey}'", connectionStringKey);
         }
+
+        static ILog log = LogManager.GetLogger<ServiceControlSqsTransport>();
     }
 }