aws / aws/aws-toolkit-vscode

AWS Tool kit/Amazon Q Developer extension: Cannot authenticate using AWS SSO when connected via Remote SSH extension on AWS ec2 instance

Open
#6,595 4 comments 0 reactions 0 assignees View on GitHub
amazon-q auth-credentials guidance remote-execute service:ec2
Dominant language
TypeScript
Stars
2k
Forks
807
Avg merge
10h 12m
Merged PRs (30d)
7

Description

## System details (run `AWS: About` and/or `Amazon Q: About`)
- OS: Linux x64 6.1.109-118.189.amzn2023.x86_64
- Visual Studio Code extension host: 1.97.0
- AWS Toolkit: 3.46.0
- Amazon Q: 1.47.0

## Question
I use VSCode to develop python scripts on a AWS ec2-instance using Remote-SSH [see vscode documentation](https://code.visualstudio.com/docs/remote/ssh). I'd like to use AWS Toolkit and Amazon Q Developer Pro. I installed the extensions via vscode marketplace on the AWS ec2 instance - no erros. But when I try to connect to AWS IAM Identity Center I get the following error:

```

[error] API response (oidc.eu-central-1.amazonaws.com /client/register): {
errno: -104,
code: 'ECONNRESET',
syscall: 'read',
name: 'TimeoutError'
}

[error] ssoSetup encountered an error: TimeoutError: read ECONNRESET [ECONNRESET]
[error] webviewId="aws.toolkit.AmazonCommonAuth": Error: Webview error
-> Error: Webview backend command failed: "createIdentityCenterConnection()"
-> TimeoutError: read ECONNRESET [ECONNRESET]
```

When I try the same in a different VSCode dev project with AWS Toolkit and/or Amazon Q Developer installed locally (no remote SSH involved) - it works fine

I configured aws cli on the AWS ec2 instance and configured SSO and executing aws sso login --sso-session --no-browse - it works fine when manually copying the URL to a browser to authenticate

I suppose it fails because the remote ssh/AWS ec2 instance cannot manage to open a browser for signing-in to AWS IAM Identity Center. On https://code.visualstudio.com I found something: [code.visualstudio.com/docs/remote/…](https://code.visualstudio.com/docs/remote/troubleshooting#_browser-does-not-open-locally). Sounds to me that AWS Toolkit/Amazon Q Developer extensions must implement vscode.env.openExternal API

How can I get this to work

Thank you so much for your assistance

Contributor guide

Open the contributing guide

Research direction

Reproduce the IAM Identity Center sign-in through VS Code Remote-SSH and compare it with the working local flow. Start at createIdentityCenterConnection and the reported vscode.env.openExternal browser handoff; done means remote authentication completes without the ECONNRESET or webview error.

Written by the indexing model from the issue text.

Assessment

Tech stack
aws, typescript, vscode
Domain
authentication, cloud, developer-experience
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.