Add note about aws configure export-credentials

[jaklan]

After merging and releasing aws/aws-cli#7398, I believe aws configure export-credentials should be the recommended solution. It would be worth to note in the README.md that aws-export-credentials is either a legacy solution (is it?) or highlight differences between these two approaches.

[jaklan]

Actually - I already see one difference: aws configure export-credentials doesn't generate any new credentials, just utilise what's able to find in envars / ~/.aws/credentials / ~/.aws/cli/cache, but aws-export-credentials exports new credentials each time it's executed - I believe because it takes different approach and creates a new botocore session each time and exports its credentials.

I mean - the latter is already mentioned in docs at the very beginning:

There are a number of other projects that extract AWS credentials and/or inject them into programs, but all the ones I've seen use the CLI's cache files directly, rather than leveraging botocore's ability to retrieve and refresh credentials. So I wrote this to do that.

but maybe it's not intuitive aws configure export-credentials works differently.

[benkehoe]

Oh, hm. Would we consider this a bug in the CLI's implementation?

[jaklan]

I believe it's done this way on purpose in AWS CLI, to avoid any additional side effects of running export command. Actually aws-export-credentials is the one which is more like aws-retrieve-and-export-new-credentials 😉

[benkehoe]

I believe the AWS CLI's implementation does refresh credentials, because it uses the normal credential resolution mechanisms of the AWS CLI (and botocore). I've added a note to the README in 33a6013

[jaklan]

@benkehoe actually I meant sth different - that aws-export-credentials each time creates a new session and returns new credentials, but aws configure export-credentials relies on the current session and returns the same credentials (until there's a need to refresh, as you mentioned, but that's another thing).

[benkehoe]

Oh, yes, I see. If there are unexpired credentials in ~/.aws/cli/cache, aws configure export-credentials can use those. But boto3 does not use that cache, so aws-export-credentials does not either, but it does provide a separate, optional caching mechanism.

[jaklan]

Yeah yeah, I got it, just wanted to highlight the difference, but I see I already did that on January 😄

I believe it's done this way on purpose in AWS CLI, to avoid any additional side effects of running export command. Actually aws-export-credentials is the one which is more like aws-retrieve-and-export-new-credentials 😉