AWS NodeJS SDK v3：如何让SQSClient显式凭证覆盖本地配置？

你的代码核心问题是构造SQSClient时传入的配置格式错误：你把config对象嵌套在了{ config }里传给客户端，导致SDK没有正确识别你显式设置的凭证，转而触发了默认的凭证查找链（优先读取本地~/.aws/credentials文件）。

修正后的代码 #

import { paginateListQueues, SQSClientConfig, SQSClient } from '@aws-sdk/client-sqs';
import { AwsCredentialIdentity } from '@aws-sdk/types';

export class AwsApiClientService {

  private awsApiClient: SQSClient;
  private credentials: AwsCredentialIdentity;

  constructor(awsAccessKeyId: string, awsSecretAccessKey: string, region: string ) {
    this.credentials = { accessKeyId: awsAccessKeyId, secretAccessKey: awsSecretAccessKey }
    // 直接将config对象传给SQSClient，不需要额外嵌套{ config }
    const config: SQSClientConfig = { credentials: this.credentials, region: region }
    this.awsApiClient = new SQSClient(config);
  }

  public async getListOfCustomerQueues() {
    const paginatedListQueues = paginateListQueues({ client: this.awsApiClient }, {});

    const urls: string[] = [];
    for await (const page of paginatedListQueues) {
      const nextUrls = page.QueueUrls?.filter((qurl) => !!qurl) || [];
      urls.push(...nextUrls);
      urls.forEach((url) => console.log(url));
    }

    return urls;
  }
}

额外说明（可选） #

如果需要彻底禁用默认凭证链（避免任何意外的凭证来源），可以显式指定credentialProvider为静态凭证提供者，确保只使用你传入的凭证：

import { fromStatic } from '@aws-sdk/credential-provider-static';

// 在构造函数中修改config：
const config: SQSClientConfig = {
  credentialProvider: fromStatic(this.credentials),
  region: region
}
this.awsApiClient = new SQSClient(config);

这样可以完全绕过默认的凭证查找逻辑，强制使用你显式设置的凭证。

内容的提问来源于stack exchange，提问作者thxmike