fix: Do not attempt to load default credentials when `credential_prov…

…ider` is given (#19589)

crates/polars-io/src/cloud/options.rs

@@ -280,7 +280,14 @@ impl CloudOptions {
     pub async fn build_aws(&self, url: &str) -> PolarsResult<impl object_store::ObjectStore> {
         use super::credential_provider::IntoCredentialProvider;
 
-        let mut builder = AmazonS3Builder::from_env().with_url(url);
+        let mut builder = {
+            if self.credential_provider.is_none() {
+                AmazonS3Builder::from_env()
+            } else {
+                AmazonS3Builder::new()
+            }
+        }
+        .with_url(url);
         if let Some(options) = &self.config {
             let CloudConfig::Aws(options) = options else {
                 panic!("impl error: cloud type mismatch")
@@ -393,7 +400,11 @@ impl CloudOptions {
     pub fn build_azure(&self, url: &str) -> PolarsResult<impl object_store::ObjectStore> {
         use super::credential_provider::IntoCredentialProvider;
 
-        let mut builder = MicrosoftAzureBuilder::from_env();
+        let mut builder = if self.credential_provider.is_none() {
+            MicrosoftAzureBuilder::from_env()
+        } else {
+            MicrosoftAzureBuilder::new()
+        };
         if let Some(options) = &self.config {
             let CloudConfig::Azure(options) = options else {
                 panic!("impl error: cloud type mismatch")
@@ -434,7 +445,11 @@ impl CloudOptions {
     pub fn build_gcp(&self, url: &str) -> PolarsResult<impl object_store::ObjectStore> {
         use super::credential_provider::IntoCredentialProvider;
 
-        let mut builder = GoogleCloudStorageBuilder::from_env();
+        let mut builder = if self.credential_provider.is_none() {
+            GoogleCloudStorageBuilder::from_env()
+        } else {
+            GoogleCloudStorageBuilder::new()
+        };
         if let Some(options) = &self.config {
             let CloudConfig::Gcp(options) = options else {
                 panic!("impl error: cloud type mismatch")

py-polars/tests/unit/io/cloud/test_credential_provider.py

@@ -0,0 +1,22 @@
+import pytest
+
+import polars as pl
+from polars.exceptions import ComputeError
+
+
+def test_credential_provider_skips_config_autoload(
+    monkeypatch: pytest.MonkeyPatch,
+) -> None:
+    monkeypatch.setenv("GOOGLE_SERVICE_ACCOUNT_PATH", "__non_existent")
+
+    with pytest.raises(ComputeError, match="__non_existent"):
+        pl.scan_parquet("gs://.../...", credential_provider=None).collect()
+
+    err_magic = "err_magic_3"
+
+    def raises() -> pl.CredentialProviderFunctionReturn:
+        raise AssertionError(err_magic)
+
+    # We should get a different error raised by our `raises()` function.
+    with pytest.raises(ComputeError, match=err_magic):
+        pl.scan_parquet("gs://.../...", credential_provider=raises).collect()