ProfileCredentialsProvider fails if SSO information is in source profile
- Dominant language
- Java
- Stars
- 2.6k
- Forks
- 1k
- Avg merge
- 2d 9h
- Merged PRs (30d)
- 51
Description
### Describe the bug
- **Problem**
I have the following profiles in my .aws/config file (generated by a separate tool):
```
[profile xxxxx-src]
sso_account_id = 1234567890
sso_role_name = xxxxx
sso_session = xxxxx
[profile xxxxx]
source_profile = xxxxx-src
role_arn = arn:aws:iam::1234567890:role/my_nice_role
role_session_name = xxxxx
sso_session = xxxxx
```
When I try to use this profile in the AWS SDK for Java using the ProfileCredentialsProvider, I get the following error:
```
Exception in thread "main" java.lang.IllegalArgumentException: Profile property 'sso_account_id' was not configured for 'default'.
at software.amazon.awssdk.utils.Validate.isTrue(Validate.java:76)
at software.amazon.awssdk.auth.credentials.internal.ProfileCredentialsUtils.lambda$requireProperties$1(ProfileCredentialsUtils.java:291)
at java.base/java.util.Spliterators$ArraySpliterator.forEachRemaining(Spliterators.java:992)
at java.base/java.util.stream.ReferencePipeline$Head.forEach(ReferencePipeline.java:762)
at software.amazon.awssdk.auth.credentials.internal.ProfileCredentialsUtils.requireProperties(ProfileCredentialsUtils.java:291)
at software.amazon.awssdk.auth.credentials.internal.ProfileCredentialsUtils.validateRequiredPropertiesForSsoCredentialsProvider(ProfileCredentialsUtils.java:206)
at software.amazon.awssdk.auth.credentials.internal.ProfileCredentialsUtils.ssoProfileCredentialsProvider(ProfileCredentialsUtils.java:197)
at software.amazon.awssdk.auth.credentials.internal.ProfileCredentialsUtils.credentialsProvider(ProfileCredentialsUtils.java:120)
at software.amazon.awssdk.auth.credentials.internal.ProfileCredentialsUtils.credentialsProvider(ProfileCredentialsUtils.java:102)
at software.amazon.awssdk.auth.credentials.ProfileCredentialsProvider.lambda$createCredentialsProvider$1(ProfileCredentialsProvider.java:169)
at java.base/java.util.Optional.flatMap(Optional.java:289)
at software.amazon.awssdk.auth.credentials.ProfileCredentialsProvider.createCredentialsProvider(ProfileCredentialsProvider.java:169)
at software.amazon.awssdk.auth.credentials.ProfileCredentialsProvider.handleProfileFileReload(ProfileCredentialsProvider.java:135)
at software.amazon.awssdk.auth.credentials.ProfileCredentialsProvider.resolveCredentials(ProfileCredentialsProvider.java:126)
at software.amazon.awssdk.auth.credentials.AwsCredentialsProvider.resolveIdentity(AwsCredentialsProvider.java:54)
at software.amazon.awssdk.services.s3.auth.scheme.internal.S3AuthSchemeInterceptor.lambda$trySelectAuthScheme$6(S3AuthSchemeInterceptor.java:169)
at software.amazon.awssdk.core.internal.util.MetricUtils.reportDuration(MetricUtils.java:80)
at software.amazon.awssdk.services.s3.auth.scheme.internal.S3AuthSchemeInterceptor.trySelectAuthScheme(S3AuthSchemeInterceptor.java:169)
at software.amazon.awssdk.services.s3.auth.scheme.internal.S3AuthSchemeInterceptor.selectAuthScheme(S3AuthSchemeInterceptor.java:87)
at software.amazon.awssdk.services.s3.auth.scheme.internal.S3AuthSchemeInterceptor.beforeExecution(S3AuthSchemeInterceptor.java:67)
at software.amazon.awssdk.core.interceptor.ExecutionInterceptorChain.lambda$beforeExecution$1(ExecutionInterceptorChain.java:59)
at java.base/java.util.ArrayList.forEach(ArrayList.java:1511)
at software.amazon.awssdk.core.interceptor.ExecutionInterceptorChain.beforeExecution(ExecutionInterceptorChain.java:59)
at software.amazon.awssdk.awscore.internal.AwsExecutionContextBuilder.runInitialInterceptors(AwsExecutionContextBuilder.java:255)
at software.amazon.awssdk.awscore.internal.AwsExecutionContextBuilder.invokeInterceptorsAndCreateExecutionContext(AwsExecutionContextBuilder.java:144)
at software.amazon.awssdk.awscore.client.handler.AwsSyncClientHandler.invokeInterceptorsAndCreateExecutionContext(AwsSyncClientHandler.java:67)
at software.amazon.awssdk.core.internal.handler.BaseSyncClientHandler.lambda$execute$1(BaseSyncClientHandler.java:76)
at software.amazon.awssdk.core.internal.handler.BaseSyncClientHandler.measureApiCallSuccess(BaseSyncClientHandler.java:182)
at software.amazon.awssdk.core.internal.handler.BaseSyncClientHandler.execute(BaseSyncClientHandler.java:74)
at software.amazon.awssdk.core.client.handler.SdkSyncClientHandler.execute(SdkSyncClientHandler.java:45)
at software.amazon.awssdk.awscore.client.handler.AwsSyncClientHandler.execute(AwsSyncClientHandler.java:53)
```
The SDK does not seem to be looking in the source profile for this information.
### Regression Issue
- [ ] Select this option if this issue appears to be a regression.
### Expected Behavior
The SDK should look in the source profile for the SSO information.
### Current Behavior
The login fails because the SDK does not seem to be looking in the source profile for the SSO information.
### Reproduction Steps
`ProfileCredentialsProvider.create("xxxxx")`
with the following profiles:
```
[profile xxxxx-src]
sso_account_id = 1234567890
sso_role_name = xxxxx
sso_session = xxxxx
[profile xxxxx]
source_profile = xxxxx-src
role_arn = arn:aws:iam::1234567890:role/my_nice_role
role_session_name = xxxxx
sso_session = xxxxx
```
Login using `aws sso login --sso-session xxxxx`
### Possible Solution
In the ProfileCredentialsUtils class, and the `credentialsProvider(Set children)` method, if the source profile check would be moved to the top, this scenario would work fine.
### Additional Information/Context
_No response_
### AWS Java SDK version used
2.31.63
### JDK version used
17.0.9_8
### Operating System and version
Windows 11 Enterprise 23H2
Contributor guide
Assessment
This issue has not been assessed yet.