detect-aws-credentials fails when no credentials are set

As part of our developer setup, each person installs the pre-commit and inherits the project’s hooks, but not everyone has aws credentials set up, so detect-aws-credentials will product a failure when the individual hasn’t set any keys file or has any exported to their env.

https://github.com/pre-commit/pre-commit-hooks/blob/20f04626a1ee7eb34955d775a37aa9a56a0a7448/pre_commit_hooks/detect_aws_credentials.py#L112

I’m not sure of the best way to handle this within the current logic - I’d rather exit 0 with a passing warning than fail, since this then forces the individual to go and set up a credentials file, even if they don’t use one.

I guess the “simple” workaround is to export AWS_SECRET_ACCESS_KEY="RANDOMSTRINGTHATNEVERTEXISTSINMYCODE!!" before running the pre-commit hooks, but this seems wrong.

[asottile]

it can, that’s what --allow-missing-credentials is for

the reason it does not do that by default, is you may not have your credentials configured properly and therefore it can’t protect you against mistakes

[Dunedan]

Failing when no credentials are configured has been the behavior since the very first version of this hook. An obvious solution would be of course to simple remove the following lines: https://github.com/pre-commit/pre-commit-hooks/blob/master/pre_commit_hooks/detect_aws_credentials.py#L114-L120

I agree that removing those lines would allow silent failures in cases where a user with credentials in some obscure location installs the hook and expects it to work without having tested it.

My proposal to solve this problem is to simply introduce an additional argument for the script, providing the ability to simply disable failures when no credentials are found, but keeping the current behavior the default.