feat(aws): support keyless authentication (IRSA / instance profile)

Make aws_access_key/aws_secret_key optional. When omitted, fall back to
the AWS SDK default credential chain so IRSA, EC2/ECS instance profiles,
env vars and shared config work without injecting static creds into the
provider config.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Author: sagnikhaldar

PROVIDERS.md

@@ -9,9 +9,9 @@ Amazon Web Services can be integrated by using the following configuration block
   provider: aws
   # id is the name defined by user for filtering (optional)
   id: staging
-  # aws_access_key is the access key for AWS account
+  # aws_access_key is the access key for AWS account (optional - see "Keyless Authentication" below)
   aws_access_key: $AWS_ACCESS_KEY
-  # aws_secret_key is the secret key for AWS account
+  # aws_secret_key is the secret key for AWS account (optional - see "Keyless Authentication" below)
   aws_secret_key: $AWS_SECRET_KEY
   # aws_session_token session token for temporary security credentials retrieved via STS (optional)
   aws_session_token: $AWS_SESSION_TOKEN
@@ -31,6 +31,24 @@ Amazon Web Services can be integrated by using the following configuration block
 
 `aws_access_key` and `aws_secret_key` can be generated in the IAM console. We recommend creating a new IAM user with `Read Only` permissions and providing the access token for the user.
 
+#### Keyless Authentication (IRSA / Instance Profile / Environment)
+
+`aws_access_key` and `aws_secret_key` are **optional**. When both are omitted, the provider falls back to the AWS SDK default credential chain, so no secrets need to be injected into the config file. This enables:
+
+- **IRSA (IAM Roles for Service Accounts)** on EKS — credentials are picked up automatically from the `AWS_WEB_IDENTITY_TOKEN_FILE` and `AWS_ROLE_ARN` environment variables injected by the pod identity webhook.
+- **EC2 / ECS instance profiles** — credentials are resolved from the instance/task metadata endpoint.
+- **Environment variables** — `AWS_ACCESS_KEY_ID`, `AWS_SECRET_ACCESS_KEY`, `AWS_SESSION_TOKEN`.
+- **Shared config / profile** — `~/.aws/credentials` and `~/.aws/config`.
+
+```yaml
+# Zero-key config relying on IRSA / instance profile / environment
+- provider: aws
+  id: keyless-discovery
+  # no aws_access_key / aws_secret_key — credentials resolved by the SDK default chain
+```
+
+> Note: if you provide one of `aws_access_key` / `aws_secret_key`, you must provide both. `assume_role_arn`, `assume_role_name` and `org_discovery_role_arn` all work on top of keyless base credentials too.
+
 Scopes Required - 
 1. EC2
 2. Route53

README.md

@@ -38,6 +38,7 @@ Cloudlist is a multi-cloud tool for getting Assets from Cloud Providers. This is
 
  - List Cloud assets with multiple configurations
  - Multiple Cloud providers support
+ - Keyless authentication support (AWS IRSA / instance profiles, GCP workload identity)
  - Multiple output format support
  - Multiple filters support
  - Highly extensible making adding new providers a breeze

pkg/providers/aws/aws.go

@@ -49,13 +49,16 @@ type ProviderOptions struct {
 
 func (p *ProviderOptions) ParseOptionBlock(block schema.OptionBlock) error {
 	p.Id, _ = block.GetMetadata("id")
-	accessKey, ok := block.GetMetadata(apiAccessKey)
-	if !ok {
-		return &schema.ErrNoSuchKey{Name: apiAccessKey}
-	}
-	accessToken, ok := block.GetMetadata(apiSecretKey)
-	if !ok {
-		return &schema.ErrNoSuchKey{Name: apiSecretKey}
+	// aws_access_key/aws_secret_key are optional. When both are omitted the
+	// provider falls back to the AWS SDK default credential chain, which
+	// supports keyless auth such as IRSA (IAM Roles for Service Accounts),
+	// EC2/ECS instance profiles and AWS_* environment variables.
+	accessKey, _ := block.GetMetadata(apiAccessKey)
+	accessToken, _ := block.GetMetadata(apiSecretKey)
+	// If one of the static-credential pair is set, both must be set;
+	// a half-configured pair is almost always a mistake.
+	if (accessKey == "") != (accessToken == "") {
+		return errors.Errorf("both %s and %s must be provided together", apiAccessKey, apiSecretKey)
 	}
 	p.Token, _ = block.GetMetadata(sessionToken)
 	p.AccessKey = accessKey
@@ -156,7 +159,13 @@ func New(block schema.OptionBlock) (*Provider, error) {
 	provider := &Provider{options: options}
 	config := aws.NewConfig()
 	config.WithRegion("us-east-1")
-	config.WithCredentials(credentials.NewStaticCredentials(options.AccessKey, options.SecretKey, options.Token))
+	// Only set static credentials when explicitly provided. Otherwise leave
+	// config.Credentials nil so session.NewSession resolves credentials via the
+	// SDK default chain (env vars, shared config, IRSA web identity, EC2/ECS
+	// instance profile), enabling keyless authentication.
+	if options.AccessKey != "" && options.SecretKey != "" {
+		config.WithCredentials(credentials.NewStaticCredentials(options.AccessKey, options.SecretKey, options.Token))
+	}
 
 	var sess *session.Session
 	var err error