auth: credentials set in environment (by "direnv") not used in UI
- Dominant language
- TypeScript
- Stars
- 2k
- Forks
- 807
- Avg merge
- 10h 12m
- Merged PRs (30d)
- 7
Description
## Problem
The UI and corresponding API calls to AWS are not using the expected credentials based on the selected profile. These profiles and accounts are actively used for CDK deployments and operations with the AWS CLI, so I am reasonably confident this issue is specific to `aws-toolkit-vscode` and not the implementation of configuration / IAM permissions.
## Steps to reproduce the issue
Set AWS Credentials of user from AccountA in env:
```
AWS_ACCESS_KEY_ID=XXX
AWS_SECRET_ACCESS_KEY=XXX
```
Set custom config dir (unknown if this impacts the bug but as it is part of our setup I am including it)
```
export AWS_CONFIG_FILE=/path/to/config
```
Set profile in config
```
[profile accountBProfile]
credential_source = Environment
region = us-west-2
role_arn = arn:aws:iam:::role/
```
Attempt to use Extension.
## Expected behavior
The expected behavior would be for the UI and subsequent API calls to use credentials generated from the profile `accountBProfile` and call the services residing on `AccountB`.
## Actual behavior
From the logs I am viewing, it appears the credentials are changing to `accountBProfile`, however, the subsequent API calls are being made from AWS Credentials corresponding to the user of `AccountA` and being made to the corresponding service on `AccountA`.
(naming modified to fit reproduction steps):
```
023-03-24 02:52:26 [DEBUG]: command: running "_aws.auth.reauthenticate" with arguments [[object Object], [object Object]]
2023-03-24 02:52:26 [VERBOSE]: Profile accountBProfile contains credential_source - treating as Environment Credentials
2023-03-24 02:52:26 [DEBUG]: telemetry: emitted metric "vscode_executeCommand"
2023-03-24 02:52:26 [VERBOSE]: provider for instance unavailable in this environment
2023-03-24 02:52:26 [VERBOSE]: provider for instance unavailable in this environment
2023-03-24 02:52:26 [DEBUG]: telemetry: emitted metric "aws_loadCredentials"
2023-03-24 02:52:26 [DEBUG]: telemetry: emitted metric "aws_loadCredentials"
2023-03-24 02:52:37 [DEBUG]: command: running "aws.codeWhisperer.refresh"
2023-03-24 02:52:37 [DEBUG]: command: running "aws.codeWhisperer.refreshRootNode"
2023-03-24 02:52:37 [DEBUG]: command: running "aws.codeWhisperer.refreshStatusBar"
2023-03-24 02:52:37 [DEBUG]: command: running "aws.codeWhisperer.updateReferenceLog"
2023-03-24 02:52:37 [DEBUG]: command: running "aws.refreshAwsExplorerNode" with arguments [[object Object]]
2023-03-24 02:52:37 [DEBUG]: commands: skipped telemetry for "aws.codeWhisperer.refresh"
2023-03-24 02:52:37 [DEBUG]: commands: skipped telemetry for "aws.codeWhisperer.refreshRootNode"
2023-03-24 02:52:37 [DEBUG]: commands: skipped telemetry for "aws.codeWhisperer.refreshStatusBar"
2023-03-24 02:52:37 [DEBUG]: commands: skipped telemetry for "aws.codeWhisperer.updateReferenceLog"
2023-03-24 02:52:37 [DEBUG]: commands: skipped telemetry for "aws.refreshAwsExplorerNode"
2023-03-24 02:52:37 [DEBUG]: telemetry: emitted metric "aws_setCredentials"
2023-03-24 02:52:37 [DEBUG]: commands: skipped telemetry for "aws.auth.switchConnections"
2023-03-24 02:52:37 [VERBOSE]: Credentials changed (profile:accountBProfile), updating AWS Explorer
2023-03-24 02:52:37 [DEBUG]: telemetry: emitted metric "aws_validateCredentials"
2023-03-24 02:52:47 [ERROR]: AccessDenied: User: arn:aws:iam:::user/ is not authorized to perform: cloudformation:ListStacks on resource: arn:aws:cloudformation:us-west-2::stack/*/* because no identity-based policy allows the cloudformation:ListStacks action
```
## System details (run the `AWS: About Toolkit` command)
```
2023-03-24 02:27:54 [INFO]: OS: Darwin arm64 22.2.0
2023-03-24 02:27:54 [INFO]: Visual Studio Code extension host: 1.76.2
2023-03-24 02:27:54 [INFO]: AWS Toolkit: 1.65.0
2023-03-24 02:27:54 [INFO]: node: 16.14.2
2023-03-24 02:27:54 [INFO]: electron: 19.1.11
```
Contributor guide
Research direction
Reproduce the setup with AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY, AWS_CONFIG_FILE, and accountBProfile, then inspect the credential-loading logs and AWS Explorer/API calls. Use the AWS: About Toolkit command for the reported environment details. Done means the UI and subsequent AWS calls use accountBProfile's assumed AccountB credentials rather than AccountA.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- aws, typescript, vscode
- Domain
- authentication, cloud, tooling
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100