aws / aws/aws-cdk

ssm: Error: Cannot retrieve value from context provider ssm since account/region are not specified

Open
#33,956 1 comment 1 reaction 0 assignees View on GitHub
@aws-cdk/aws-ssm bug effort/medium p2
Dominant language
TypeScript
Stars
12.9k
Forks
4.6k
Avg merge
2d 3h
Merged PRs (30d)
83

Description

### Describe the bug

When an SSO session has expired, instead of warning that SSO session has expired, CDK will instead imply that the account, and region are not set, when they are indeed set according the verbose logging:

```
[21:11:42] Reading cached notices from /Users/jordon/.cdk/cache/notices.json
[21:11:42] Toolkit stack: CDKToolkit
[21:11:42] Setting "CDK_DEFAULT_REGION" environment variable to us-east-1
[21:11:42] Unable to determine the default AWS account (CredentialsProviderError): The SSO session associated with this profile has expired. To refresh this SSO session run aws sso login with the corresponding profile.
[21:11:42] context: {
'acknowledged-issue-numbers': [ 32775, 32775 ],
'vpc-provider:account=000000000000:filter.isDefault=true:region=us-east-1:returnAsymmetricSubnets=true': {
vpcId: 'vpc-00000000000000000',
vpcCidrBlock: '172.31.0.0/16',
ownerAccountId: '000000000000',
availabilityZones: [],
subnetGroups: [ [Object] ]
},
```

### Regression Issue

- [ ] Select this option if this issue appears to be a regression.

### Last Known Working CDK Version

_No response_

### Expected Behavior

I really expect it to set the info and then throw a permission error on the API, or to warn I'm not logged in

### Current Behavior

It tells me the info doesn't exist when it indeed does

### Reproduction Steps

```ts
import * as cdk from "aws-cdk-lib";
import type { Construct } from 'constructs';
import { get } from 'env-var';

const app = new cdk.App();
const { CDK_DEFAULT_ACCOUNT: account, CDK_DEFAULT_REGION: region } = process.env
const appName = get('APP_NAME').required().asString();
const envName = get('ENV_NAME').required().asString();

interface MyStackProps extends cdk.StackProps {
envName: string;
appName: string;
}

class MyStack extends cdk.Stack {
public readonly app: string;
public readonly env: string;

constructor(
scope: Construct,
id: string, props?: MyStackProps
) {
super(
scope, id, props
);

this.app = props!.app
this.env = props!.env
const key = '/app/dev/key-name'
const arn = ssm.StringParameter.valueFromLookup(
this, key
);
}
}

new MyStack(
app, 'MyStack', {
envName,
appName,
env: {
region, account
}
}
)
```

### Possible Solution

_No response_

### Additional Information/Context

_No response_

### CDK CLI Version

2.1005.0

### Framework Version

2.185.0

### Node.js Version

18x

### OS

MacOS

### Language

TypeScript

### Language Version

10.9.2

### Other information

_No response_

Contributor guide

Open the contributing guide

Research direction

Start by reproducing the issue from the ssm.StringParameter.valueFromLookup call in the provided TypeScript example with an expired SSO session, and compare the verbose account and region logs with the reported error. Done means the failure distinguishes an expired SSO session from genuinely missing account or region information, with behavior matching the expected warning or permission failure.

Written by the indexing model from the issue text.

Assessment

Tech stack
aws, typescript
Domain
cloud, infrastructure
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.