SkyPilot should not require credentials for all configured clouds when --cloud flag is passed

[kuza55]

I was recently trying to start a specific instance on a specific cloud:

sky launch -c kuza-test --gpus T4:1 --cloud aws --use-spot

This ended up requiring gcloud auth as well as aws auth, which seemed clunkier than necessary.

[Michaelvll]

Thank you for the suggestion @kuza55! The main reason we require all cloud credentials is that we are trying to make sure the VM you created have the same access to those clouds as well, so you can access the bucket on the other clouds or even create VMs from there.
We can create another mode that can be turn on in our config file ~/.sky/config to disable the credential access for other clouds. Do you think that is feasible for your case?

[kuza55]

That makes sense.

Is there a way to delay asking for credentials until a bucket needs to be mounted, or specify which clouds' credentials should be plumbed?

In this case, I just wanted to do some benchmarks and didn't need any access to training data, but even in the case where I did, presumably the data would be in one cloud, rather than everywhere, so I would want to only inject the credentials from the cloud where my data resides.

[github-actions]

This issue is stale because it has been open 120 days with no activity. Remove stale label or comment or this will be closed in 10 days.

[Michaelvll]

This issue should be fixed by #3556. You could be able to specify the clouds to use with the following specification in ~/.sky/config.yaml:

allowed_clouds: [aws,gcp]