aws / aws/aws-sdk-java-v2

ProfileCredentialsProvider fails if SSO information is in source profile

Open
#6,187 2 comments 0 reactions 0 assignees View on GitHub
bug p2
Dominant language
Java
Stars
2.6k
Forks
1k
Avg merge
2d 9h
Merged PRs (30d)
51

Description

### Describe the bug

- **Problem**

I have the following profiles in my .aws/config file (generated by a separate tool):
```
[profile xxxxx-src]
sso_account_id = 1234567890
sso_role_name = xxxxx
sso_session = xxxxx

[profile xxxxx]
source_profile = xxxxx-src
role_arn = arn:aws:iam::1234567890:role/my_nice_role
role_session_name = xxxxx
sso_session = xxxxx
```

When I try to use this profile in the AWS SDK for Java using the ProfileCredentialsProvider, I get the following error:
```
Exception in thread "main" java.lang.IllegalArgumentException: Profile property 'sso_account_id' was not configured for 'default'.
at software.amazon.awssdk.utils.Validate.isTrue(Validate.java:76)
at software.amazon.awssdk.auth.credentials.internal.ProfileCredentialsUtils.lambda$requireProperties$1(ProfileCredentialsUtils.java:291)
at java.base/java.util.Spliterators$ArraySpliterator.forEachRemaining(Spliterators.java:992)
at java.base/java.util.stream.ReferencePipeline$Head.forEach(ReferencePipeline.java:762)
at software.amazon.awssdk.auth.credentials.internal.ProfileCredentialsUtils.requireProperties(ProfileCredentialsUtils.java:291)
at software.amazon.awssdk.auth.credentials.internal.ProfileCredentialsUtils.validateRequiredPropertiesForSsoCredentialsProvider(ProfileCredentialsUtils.java:206)
at software.amazon.awssdk.auth.credentials.internal.ProfileCredentialsUtils.ssoProfileCredentialsProvider(ProfileCredentialsUtils.java:197)
at software.amazon.awssdk.auth.credentials.internal.ProfileCredentialsUtils.credentialsProvider(ProfileCredentialsUtils.java:120)
at software.amazon.awssdk.auth.credentials.internal.ProfileCredentialsUtils.credentialsProvider(ProfileCredentialsUtils.java:102)
at software.amazon.awssdk.auth.credentials.ProfileCredentialsProvider.lambda$createCredentialsProvider$1(ProfileCredentialsProvider.java:169)
at java.base/java.util.Optional.flatMap(Optional.java:289)
at software.amazon.awssdk.auth.credentials.ProfileCredentialsProvider.createCredentialsProvider(ProfileCredentialsProvider.java:169)
at software.amazon.awssdk.auth.credentials.ProfileCredentialsProvider.handleProfileFileReload(ProfileCredentialsProvider.java:135)
at software.amazon.awssdk.auth.credentials.ProfileCredentialsProvider.resolveCredentials(ProfileCredentialsProvider.java:126)
at software.amazon.awssdk.auth.credentials.AwsCredentialsProvider.resolveIdentity(AwsCredentialsProvider.java:54)
at software.amazon.awssdk.services.s3.auth.scheme.internal.S3AuthSchemeInterceptor.lambda$trySelectAuthScheme$6(S3AuthSchemeInterceptor.java:169)
at software.amazon.awssdk.core.internal.util.MetricUtils.reportDuration(MetricUtils.java:80)
at software.amazon.awssdk.services.s3.auth.scheme.internal.S3AuthSchemeInterceptor.trySelectAuthScheme(S3AuthSchemeInterceptor.java:169)
at software.amazon.awssdk.services.s3.auth.scheme.internal.S3AuthSchemeInterceptor.selectAuthScheme(S3AuthSchemeInterceptor.java:87)
at software.amazon.awssdk.services.s3.auth.scheme.internal.S3AuthSchemeInterceptor.beforeExecution(S3AuthSchemeInterceptor.java:67)
at software.amazon.awssdk.core.interceptor.ExecutionInterceptorChain.lambda$beforeExecution$1(ExecutionInterceptorChain.java:59)
at java.base/java.util.ArrayList.forEach(ArrayList.java:1511)
at software.amazon.awssdk.core.interceptor.ExecutionInterceptorChain.beforeExecution(ExecutionInterceptorChain.java:59)
at software.amazon.awssdk.awscore.internal.AwsExecutionContextBuilder.runInitialInterceptors(AwsExecutionContextBuilder.java:255)
at software.amazon.awssdk.awscore.internal.AwsExecutionContextBuilder.invokeInterceptorsAndCreateExecutionContext(AwsExecutionContextBuilder.java:144)
at software.amazon.awssdk.awscore.client.handler.AwsSyncClientHandler.invokeInterceptorsAndCreateExecutionContext(AwsSyncClientHandler.java:67)
at software.amazon.awssdk.core.internal.handler.BaseSyncClientHandler.lambda$execute$1(BaseSyncClientHandler.java:76)
at software.amazon.awssdk.core.internal.handler.BaseSyncClientHandler.measureApiCallSuccess(BaseSyncClientHandler.java:182)
at software.amazon.awssdk.core.internal.handler.BaseSyncClientHandler.execute(BaseSyncClientHandler.java:74)
at software.amazon.awssdk.core.client.handler.SdkSyncClientHandler.execute(SdkSyncClientHandler.java:45)
at software.amazon.awssdk.awscore.client.handler.AwsSyncClientHandler.execute(AwsSyncClientHandler.java:53)
```

The SDK does not seem to be looking in the source profile for this information.

### Regression Issue

- [ ] Select this option if this issue appears to be a regression.

### Expected Behavior

The SDK should look in the source profile for the SSO information.

### Current Behavior

The login fails because the SDK does not seem to be looking in the source profile for the SSO information.

### Reproduction Steps

`ProfileCredentialsProvider.create("xxxxx")`

with the following profiles:

```
[profile xxxxx-src]
sso_account_id = 1234567890
sso_role_name = xxxxx
sso_session = xxxxx

[profile xxxxx]
source_profile = xxxxx-src
role_arn = arn:aws:iam::1234567890:role/my_nice_role
role_session_name = xxxxx
sso_session = xxxxx
```

Login using `aws sso login --sso-session xxxxx`

### Possible Solution

In the ProfileCredentialsUtils class, and the `credentialsProvider(Set children)` method, if the source profile check would be moved to the top, this scenario would work fine.

### Additional Information/Context

_No response_

### AWS Java SDK version used

2.31.63

### JDK version used

17.0.9_8

### Operating System and version

Windows 11 Enterprise 23H2

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.