Profile based credentials don't work with credential_process

[prencher]

• I'm submitting a ...

  • 🪲 bug report
  • 🚀 feature request
  • 📚 construct library gap
  • ☎️ security issue or vulnerability => Please see policy
  • ❓ support request => Please see note at the top of this template.

• What is the current behavior?
  If the current behavior is a 🪲bug🪲: Please provide the steps to reproduce

When using --profile (see also #3007), the CLI doesn't respect credential_process. The profile has to have hardcoded credentials.

• What is the expected behavior (or behavior of feature suggested)?

credentials_process is respected and invoked the same way other AWS CLI tools do.

• What is the motivation / use case for changing the behavior or adding this feature?

Parity with AWS CLI.

• Please tell us about your environment:

  • CDK CLI Version: 0.35.0
  • Module Version: 0.35.0
  • OS: macOS Mojave
  • Language: TypeScript

[rix0rrr]

Limitation of the AWS SDK for JavaScript we're using. Nothing to do for us here, you should file a feature request with them: https://github.com/aws/aws-sdk-js

Duplicate: #1656

[mb-dev]

@rix0rrr is that the case? I am seeing some PRs that implement credentials_process: aws/aws-sdk-js#2559

[rclark]

@rix0rrr could you please reopen this ticket? The aws-sdk-js DOES support process credentials now.

[rclark]

aws-cdk/packages/aws-cdk/lib/api/aws-auth/awscli-compatible.ts

Lines 42 to 45 in 986e281

	const sources = [
	() => new AWS.EnvironmentCredentials('AWS'),
	() => new AWS.EnvironmentCredentials('AMAZON'),
	];

I can hack my way to making this work by adding a line here, though there may be other consequences...

    const sources = [
      () => new AWS.EnvironmentCredentials('AWS'),
      () => new AWS.EnvironmentCredentials('AMAZON'),
      () => new AWS.ProcessCredentials({ profile }),
    ];

[3oris]

Please reopen!

[shivlaks]

marking as p1 to prioritize a fix

[LuqiPan]

[not a contribution]

Hey is there any update on this issue?

[pahud]

JS SDK now supports process_credentials now. Please check out my demo here:

pahud/gitpod-workspace#1 (comment)

However, AWS CDK does not support it. Can we add support for it given JS SDK supports it now?

[hoegertn]

@shivlaks @rix0rrr Is there anything I can help to make this work? AWS SSO is marketed as the way to configure your users in a multi-account setup but CDK is then not usable.

[pahud]

I believe we probably need update

aws-cdk/packages/aws-cdk/lib/api/aws-auth/aws-sdk-inifile.ts

Line 29 in 905f661

export class PatchedSharedIniFileCredentials extends AWS.SharedIniFileCredentials {

or

aws-cdk/packages/aws-cdk/lib/api/aws-auth/awscli-compatible.ts

Line 35 in 905f661

public static async credentialChain(options: CredentialChainOptions = {}) {

And determine if credential_process is configured in the profile. If yes, we simply return the AWS.ProcessCredentials to the credential provider chain and it should work.

[github-actions]

⚠️COMMENT VISIBILITY WARNING⚠️

Comments on closed issues are hard for our team to see.
If you need more assistance, please either tag a team member or open a new issue that references this one.
If you wish to keep having a conversation with other community members under this issue feel free to do so.