AWS SSO authentication fails with: Error: Unable to authenticate connection
- Dominant language
- TypeScript
- Stars
- 2k
- Forks
- 807
- Avg merge
- 10h 12m
- Merged PRs (30d)
- 7
Description
## Problem
The extension looks amazing but I'm having trouble using it. I'm trying to get the extension to authenticate using my AWS SSO account via the existing profiles I have configured, however it is unable to do so.
## Steps to reproduce the issue
1. install the AWS Toolkit extension in my dev container
2. the `~/.aws` directory is mounted into the dev container, and the `aws` cli is installed:
```sh
$ which aws
/usr/bin/aws
$ aws --version
aws-cli/2.9.19 Python/3.11.2 Linux/6.4.16-linuxkit source/aarch64.debian.12 prompt/off
```
3. Authenticate with AWS via SSO ("Successfully logged into Start URL...")
4. Open the AWS extension panel and click "Select a connection..." under "Explorer"
5. Click one of my existing SSO profiles from `~/.aws/config` (e.g., `poweruser`):
> NOTE: none of these are expired or invalid
5. Get an error:
6. Confirm error in logs:
```sh
2023-12-01 12:17:32 [INFO]: log level: info
2023-12-01 12:17:32 [INFO]: endpoints: retrieving AWS endpoints data
2023-12-01 12:17:32 [INFO]: OS: Linux arm64 6.4.16-linuxkit
2023-12-01 12:17:32 [INFO]: Visual Studio Code extension host: 1.84.2
2023-12-01 12:17:32 [INFO]: AWS Toolkit: 2.1.0
2023-12-01 12:17:32 [INFO]: node: 18.15.0
2023-12-01 12:17:32 [INFO]: telemetry cache not found: '/home/humphd/.vscode-server/data/User/globalStorage/amazonwebservices.aws-toolkit-vscode/telemetryCache'
2023-12-01 12:17:32 [WARN]: AwsContext: no default region in credentials profile, falling back to us-east-1:
2023-12-01 12:17:33 [ERROR]: Profile default is not a valid Credential Profile: not supported by the Toolkit
2023-12-01 12:17:33 [WARN]: Shared Credentials Profile default is not valid. It will not be used by the toolkit.
2023-12-01 12:18:18 [ERROR]: _aws.auth.reauthenticate: Error: Unable to authenticate connection
-> CredentialsProviderError: Command failed: aws configure export-credentials
Unable to retrieve credentials: no credentials found
```
NOTE: If I run the same command myself, it works:
```sh
$ aws configure export-credentials
{
"Version": 1,
"AccessKeyId": "...redacted",
"SecretAccessKey": "...redacted",
"SessionToken": "...redacted",
"Expiration": "2023-12-01T13:18:07+00:00"
}
```
## Expected behavior
I would expect the extension to be able to use my current logged in SSO session without me having to do more work.
## System details (run the `AWS: About Toolkit` command)
OS: Linux arm64 6.4.16-linuxkit
Visual Studio Code extension host: 1.84.2
AWS Toolkit: 2.1.0
node: 18.15.0
Version: 1.84.2 (Universal)
Commit: 1a5daa3a0231a0fbba4f14db7ec463cf99d7768e
Date: 2023-11-09T10:52:33.687Z (3 wks ago)
Electron: 25.9.2
ElectronBuildId: 24603566
Chromium: 114.0.5735.289
Node.js: 18.15.0
V8: 11.4.183.29-electron.0
OS: Darwin arm64 22.6.0
Contributor guide
Research direction
Start by reproducing the failure in the AWS Toolkit extension inside the dev container, using the existing SSO profile and comparing it with the working `aws configure export-credentials` command. Trace the authentication flow and logs to determine why the extension cannot retrieve credentials; done means selecting the SSO profile authenticates successfully without extra user steps.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- aws, typescript, vscode
- Domain
- authentication, cloud
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 25/100