Check if profile has stored credentials before calling credential_pro…

…cess

vault/credentialkeyring.go

@@ -18,13 +18,25 @@ func (ck *CredentialKeyring) Keys() (credentialsNames []string, err error) {
 		return credentialsNames, err
 	}
 	for _, keyName := range allKeys {
-		if !IsSessionKey(keyName) && !IsOIDCTokenKey(keyName) {
+		if IsStoredCredential(keyName) {
 			credentialsNames = append(credentialsNames, keyName)
 		}
 	}
 	return credentialsNames, nil
 }
 
+func IsStoredCredential(keyName string) bool {
+	return !IsSessionKey(keyName) && !IsOIDCTokenKey(keyName)
+}
+
+func (ck *CredentialKeyring) HasStoredCredential(credentialsName string) bool {
+	_, err := ck.Has(credentialsName)
+	if err == nil {
+		return IsStoredCredential(credentialsName)
+	}
+	return false
+}
+
 func (ck *CredentialKeyring) Has(credentialsName string) (bool, error) {
 	allKeys, err := ck.Keyring.Keys()
 	if err != nil {

vault/vault.go

@@ -271,7 +271,8 @@ func (t *tempCredsCreator) GetProviderForProfile(config *ProfileConfig) (aws.Cre
 		return NewAssumeRoleWithWebIdentityProvider(t.Keyring.Keyring, config, !t.DisableCache)
 	}
 
-	if config.HasCredentialProcess() {
+	storedCredentialForProfile := t.Keyring.HasStoredCredential(config.ProfileName)
+	if !storedCredentialForProfile && config.HasCredentialProcess() {
 		log.Printf("profile %s: using credential process", config.ProfileName)
 		return NewCredentialProcessProvider(t.Keyring.Keyring, config, !t.DisableCache)
 	}