aws / aws/aws-toolkit-vscode

Error: Unable to authenticate connection for profiles with source_profile in config for AWS Toolkit `>= 3.47.0`

Open
#6,902 5 comments 7 reactions 0 assignees View on GitHub
auth-credentials bug
Dominant language
TypeScript
Stars
2k
Forks
807
Avg merge
10h 12m
Merged PRs (30d)
7

Description

## Problem
In my company we have a setup where we have a landing profile in one account then a switch profile to a different account. My `.aws/config` looks something like this

```ini
[sso-session aws1_session]
sso_start_url = https://{domain}.awsapps.com/start
sso_region = us-east-1
sso_registration_scopes = sso:account:access

[profile Landing]
sso_session = aws1_session
sso_account_id = {landing_account_id}
sso_role_name = Landing
region = us-east-1
output = json

[profile dev]
output = json
region = us-east-1
role_arn = arn:aws:iam::{dev_account_id}:role/dev
source_profile = Landing
```

Up to and including version `3.46.0`, if I wanted to switch to profile `dev` I didn't have any problem. But from version `3.47.0` onwards I get this error

```log
[info] auth: Updating connection state of profile:dev to authenticating
[info] auth: Handling validation error of connection: profile:dev
[info] auth: Updating connection state of profile:dev to invalid
[error] _aws.toolkit.auth.reauthenticate: Error: Unable to authenticate connection
-> InvalidClientTokenId: The security token included in the request is invalid. (statusCode: 403; requestId: 00000000-0000-0000-0000-000000000000)
```

I need to mention I can switch to the `Landing` profile with no issues though.
Also, if I install version `3.46.0` I can also switch into the `dev` profile with no issues.
This happens for any with version `>= 3.47.0`

## Steps to reproduce the issue

1. Go to *Extensions* in VSCode
2. Search for AWS Toolkit
3. Uninstall if already installed
4. Click the gear icon and Install Specific Version
5. Select any >= 3.47.0
6. Edit your .aws/config file to include a profile that uses a switch role
7. Sign in using `aws sso login`
8. In VSCode try to switch into the chained profile

## Expected behavior
1. There should be no error
2. AWS Explorer should show `Connected with profile:dev`

## System details (run `AWS: About` and/or `Amazon Q: About`)

- OS: Windows_NT x64 10.0.22621
- Visual Studio Code extension host: 1.98.2
- AWS Toolkit version: >= 3.47.0
- node: 20.18.2
- electron: 34.2.0

Contributor guide

Open the contributing guide

Research direction

Reproduce the failure using the chained profiles in `.aws/config`, after signing in with `aws sso login`, and compare behavior between AWS Toolkit 3.46.0 and 3.47.0 or later. Start from the profile authentication flow reported in the logs and verify that AWS Explorer can connect to `profile:dev` without `InvalidClientTokenId`.

Written by the indexing model from the issue text.

Assessment

Tech stack
aws, typescript, vscode
Domain
authentication, cloud, devtools
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.