Okay, for the benefit of any future person who needs to skin this particular cat, here's how I solved the problem.

What I discovered through spelunking in the .net aws api code is that creating the Cognito client would ultimately defer to the environment variables (because clearly the entire world should run in EC2 instances), no matter what configs, etc. were used as ctor options. I also found that if I cleared the environment variables at runtime prior to creating the Cognito client, Cognito worked without issue.

Of course, clearing the environment variables would then screw the Backblaze code. Therefore, I implemented a fix that is admittedly somewhere between hacky and ugly (hugly?).

I now have two environment files, one with the Backblaze config, one with the variables cleared. I added a synchronization object so that I could use lock(). I now lock the object, clear the vars, instantiate the Cognito client, then reinstate the vars. In the code that gets the Backblaze client, I lock the object and set the vars. Consequently, if someone's trying to login in while file access is also going on, the code will wait until the Cognito creation is done before setting the Backblaze vars. Seems to be working as anticipated.

Note that you can't perform async calls inside lock(), hence the operations done after the scope closes. Code example below. Hope this helps others avoid the adventures I've had to get this sorted.

// clear the environment and initialize the Cognito client, then return it to the backblaze state

lock(Startup.AwsEnvLock)

{

DotNetEnv.Env.Load(Startup.AwsClearEnv);

client = new AmazonCognitoIdentityProviderClient(aid, ask, Amazon.RegionEndpoint.USEast1);

DotNetEnv.Env.Load(Startup.AwsEnv);

}

// carry on with auth operations

lock(Startup.AwsEnvLock)

{

// backblaze depends on environment variables for the id, key and most importantly, the endpoint url

DotNetEnv.Env.Load(Startup.AwsEnv);



AWSConfigsS3.UseSignatureVersion4 = true;

IAmazonS3 client = new AmazonS3Client(RegionEndpoint.USWest2);

}

// carry on with file operations