aws / aws/aws-cli

Unable to use SSO to get GovCloud credentials

Open
#7,649 17 comments 0 reactions 0 assignees View on GitHub
documentation feature-request p2 sso
Dominant language
Python
Stars
17.3k
Forks
4.6k
Avg merge
1d 2h
Merged PRs (30d)
13

Description

### Describe the bug

I have an SSO config that works on the primary partition, but not GovCloud. It might be a config issue, but since `aws configure sso` is also affected, it seems like a bug. I have this in `~/.aws/config`:
```
[profile govcloud]
sso_account_id = 012345678910
sso_role_name = my-role
region = us-gov-west-1
sso_region = us-gov-west-1
sso_start_url = https://start.us-gov-west-1.us-gov-home.awsapps.com/directory/d-1234567890#/
```
But it doesn't work:
```
$ aws --profile govcloud sso login

An error occurred (InvalidRequestException) when calling the StartDeviceAuthorization operation:
```

I've tried a few variations of the `sso_start_url` - removing the `#` & trailing slash - but get the same result.

### Expected Behavior

SSO should work with GovCloud the same as the standard partition.

### Current Behavior

Here's a redacted chunk of the debug output. Note there's a failed call to `https://oidc.us-gov-west-1.amazonaws.com/device_authorization'`.
```
$ aws --profile image-dev-gov sso login
...
2023-02-08 08:51:32,561 - MainThread - botocore.regions - DEBUG - Calling endpoint provider with parameters: {'Region': 'us-gov-west-1', 'UseDualStack': False, 'UseFIPS': False}
2023-02-08 08:51:32,561 - MainThread - botocore.regions - DEBUG - Endpoint provider result: https://oidc.us-gov-west-1.amazonaws.com
2023-02-08 08:51:32,561 - MainThread - botocore.hooks - DEBUG - Event provide-client-params.sso-oidc.StartDeviceAuthorization: calling handler
2023-02-08 08:51:32,561 - MainThread - botocore.hooks - DEBUG - Event before-parameter-build.sso-oidc.StartDeviceAuthorization: calling handler
2023-02-08 08:51:32,561 - MainThread - botocore.hooks - DEBUG - Event before-call.sso-oidc.StartDeviceAuthorization: calling handler
2023-02-08 08:51:32,561 - MainThread - botocore.endpoint - DEBUG - Making request for OperationModel(name=StartDeviceAuthorization) with params: {'url_path': '/device_authorization', 'query_string': {}, 'method': 'POST', 'headers': {'Content-Type': 'application/json', 'User-Agent': 'aws-cli/2.9.21 Python/3.11.1 Darwin/22.2.0 source/arm64 prompt/off command/sso.login'}, 'body': b'{"clientId": "redacted", "clientSecret": "redacted", "startUrl": "https://start.us-gov-west-1.us-gov-home.awsapps.com/directory/d-1234567890/"}', 'url': 'https://oidc.us-gov-west-1.amazonaws.com/device_authorization', 'context': {'client_region': 'us-gov-west-1', 'client_config': , 'has_streaming_input': False, 'auth_type': 'none'}}
2023-02-08 08:51:32,562 - MainThread - botocore.hooks - DEBUG - Event request-created.sso-oidc.StartDeviceAuthorization: calling handler >
2023-02-08 08:51:32,562 - MainThread - botocore.hooks - DEBUG - Event choose-signer.sso-oidc.StartDeviceAuthorization: calling handler
2023-02-08 08:51:32,562 - MainThread - botocore.endpoint - DEBUG - Sending http request:
2023-02-08 08:51:32,562 - MainThread - botocore.httpsession - DEBUG - Certificate path: /opt/homebrew/Cellar/awscli/2.9.21/libexec/lib/python3.11/site-packages/awscli/botocore/cacert.pem
2023-02-08 08:51:32,562 - MainThread - urllib3.connectionpool - DEBUG - Starting new HTTPS connection (1): oidc.us-gov-west-1.amazonaws.com:443
2023-02-08 08:51:32,663 - MainThread - urllib3.connectionpool - DEBUG - https://oidc.us-gov-west-1.amazonaws.com:443 "POST /device_authorization HTTP/1.1" 400 65
2023-02-08 08:51:32,664 - MainThread - botocore.parsers - DEBUG - Response headers: {'Date': 'Wed, 08 Feb 2023 16:51:32 GMT', 'Content-Type': 'application/json', 'Content-Length': '65', 'Connection': 'keep-alive', 'x-amzn-RequestId': 'a15d2c7e-6e81-4c2a-855b-78594c1c2934', 'x-amzn-ErrorType': 'InvalidRequestException:http://internal.amazon.com/coral/com.amazonaws.sso.oidc/'}
2023-02-08 08:51:32,664 - MainThread - botocore.parsers - DEBUG - Response body:
b'{"error":"invalid_request","error_description":"Invalid request"}'
2023-02-08 08:51:32,664 - MainThread - botocore.parsers - DEBUG - Response headers: {'Date': 'Wed, 08 Feb 2023 16:51:32 GMT', 'Content-Type': 'application/json', 'Content-Length': '65', 'Connection': 'keep-alive', 'x-amzn-RequestId': 'a15d2c7e-6e81-4c2a-855b-78594c1c2934', 'x-amzn-ErrorType': 'InvalidRequestException:http://internal.amazon.com/coral/com.amazonaws.sso.oidc/'}
2023-02-08 08:51:32,664 - MainThread - botocore.parsers - DEBUG - Response body:
b'{"error":"invalid_request","error_description":"Invalid request"}'
2023-02-08 08:51:32,664 - MainThread - botocore.hooks - DEBUG - Event needs-retry.sso-oidc.StartDeviceAuthorization: calling handler >
2023-02-08 08:51:32,664 - MainThread - botocore.retries.standard - DEBUG - Not retrying request.
2023-02-08 08:51:32,664 - MainThread - botocore.hooks - DEBUG - Event after-call.sso-oidc.StartDeviceAuthorization: calling handler >
2023-02-08 08:51:32,665 - MainThread - awscli.clidriver - DEBUG - Exception caught in main()
Traceback (most recent call last):
File "/opt/homebrew/Cellar/awscli/2.9.21/libexec/lib/python3.11/site-packages/awscli/clidriver.py", line 460, in main
return command_table[parsed_args.command](remaining, parsed_args)
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
File "/opt/homebrew/Cellar/awscli/2.9.21/libexec/lib/python3.11/site-packages/awscli/clidriver.py", line 595, in __call__
return command_table[parsed_args.operation](remaining, parsed_globals)
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
File "/opt/homebrew/Cellar/awscli/2.9.21/libexec/lib/python3.11/site-packages/awscli/customizations/commands.py", line 205, in __call__
rc = self._run_main(parsed_args, parsed_globals)
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
File "/opt/homebrew/Cellar/awscli/2.9.21/libexec/lib/python3.11/site-packages/awscli/customizations/sso/login.py", line 47, in _run_main
do_sso_login(
File "/opt/homebrew/Cellar/awscli/2.9.21/libexec/lib/python3.11/site-packages/awscli/customizations/sso/utils.py", line 72, in do_sso_login
return token_fetcher.fetch_token(
^^^^^^^^^^^^^^^^^^^^^^^^^^
File "/opt/homebrew/Cellar/awscli/2.9.21/libexec/lib/python3.11/site-packages/awscli/botocore/utils.py", line 3052, in fetch_token
return self._token(
^^^^^^^^^^^^
File "/opt/homebrew/Cellar/awscli/2.9.21/libexec/lib/python3.11/site-packages/awscli/botocore/utils.py", line 3037, in _token
token = self._poll_for_token(
^^^^^^^^^^^^^^^^^^^^^
File "/opt/homebrew/Cellar/awscli/2.9.21/libexec/lib/python3.11/site-packages/awscli/botocore/utils.py", line 2952, in _poll_for_token
authorization = self._authorize_client(start_url, registration)
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
File "/opt/homebrew/Cellar/awscli/2.9.21/libexec/lib/python3.11/site-packages/awscli/botocore/utils.py", line 2929, in _authorize_client
response = self._client.start_device_authorization(
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
File "/opt/homebrew/Cellar/awscli/2.9.21/libexec/lib/python3.11/site-packages/awscli/botocore/client.py", line 341, in _api_call
return self._make_api_call(operation_name, kwargs)
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
File "/opt/homebrew/Cellar/awscli/2.9.21/libexec/lib/python3.11/site-packages/awscli/botocore/client.py", line 697, in _make_api_call
raise error_class(parsed_response, operation_name)
botocore.errorfactory.InvalidRequestException: An error occurred (InvalidRequestException) when calling the StartDeviceAuthorization operation:
```

### Reproduction Steps

Unfortunately, the config for a govcloud account with sso is too large to fit in this margin :)

### Possible Solution

_No response_

### Additional Information/Context

_No response_

### CLI version used

2.9.21

### Environment details (OS name and version, etc.)

mac os 13.1

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.