PROD-2839 Better handling of empty storage secrets in aws_util

CHANGELOG.md

@@ -34,6 +34,7 @@ The types of changes are:
 ### Fixed
 - Updating the hash migration status check query to use the available indexes [#5336](https://github.com/ethyca/fides/pull/5336)
 - Fixed column resize jank on all tables in Admin UI [#5340](https://github.com/ethyca/fides/pull/5340)
+- Better handling of empty storage secrets in aws_util [#5347](https://github.com/ethyca/fides/pull/5347)
 
 ## [2.46.2](https://github.com/ethyca/fides/compare/2.46.1...2.46.2)
 

src/fides/api/util/aws_util.py

@@ -10,7 +10,7 @@
 
 def get_aws_session(
     auth_method: str,
-    storage_secrets: Dict[StorageSecrets, Any],
+    storage_secrets: Optional[Dict[StorageSecrets, Any]],
     assume_role_arn: Optional[str] = None,
 ) -> Session:
     """
@@ -19,8 +19,11 @@ def get_aws_session(
     If an `assume_role_arn` is provided, the secrets will be used to
     assume that role and return a Session instantiated with that role.
     """
+    if storage_secrets is None:
+        # set to an empty dict to allow for more dynamic code downstream
+        storage_secrets = {}
     if auth_method == AWSAuthMethod.SECRET_KEYS.value:
-        if storage_secrets is None:
+        if not storage_secrets:
             err_msg = "Storage secrets not found for S3 storage."
             logger.warning(err_msg)
             raise StorageUploadError(err_msg)

tests/ops/util/test_storage_authenticator.py

@@ -24,10 +24,12 @@ def tests_unsupported_storage_secret_type_error(self):
             )
 
     def tests_automatic_auth_method(self, loguru_caplog):
+        # credentials error raised by AWS since runtime doesn't have env credentials set up -
+        # but ensure we don't raise an exception from our own code in parsing.
         with pytest.raises(NoCredentialsError):
             get_aws_session(
                 AWSAuthMethod.AUTOMATIC.value,  # type: ignore
-                {StorageSecrets.AWS_ACCESS_KEY_ID: "aws_access_key_id"},
+                None,
             )
 
     def test_secrets_are_valid_bad_storage_type(self):