Error: Unable to authenticate connection for profiles with source_profile in config for AWS Toolkit `>= 3.47.0`
- Dominant language
- TypeScript
- Stars
- 2k
- Forks
- 807
- Avg merge
- 10h 12m
- Merged PRs (30d)
- 7
Description
## Problem
In my company we have a setup where we have a landing profile in one account then a switch profile to a different account. My `.aws/config` looks something like this
```ini
[sso-session aws1_session]
sso_start_url = https://{domain}.awsapps.com/start
sso_region = us-east-1
sso_registration_scopes = sso:account:access
[profile Landing]
sso_session = aws1_session
sso_account_id = {landing_account_id}
sso_role_name = Landing
region = us-east-1
output = json
[profile dev]
output = json
region = us-east-1
role_arn = arn:aws:iam::{dev_account_id}:role/dev
source_profile = Landing
```
Up to and including version `3.46.0`, if I wanted to switch to profile `dev` I didn't have any problem. But from version `3.47.0` onwards I get this error
```log
[info] auth: Updating connection state of profile:dev to authenticating
[info] auth: Handling validation error of connection: profile:dev
[info] auth: Updating connection state of profile:dev to invalid
[error] _aws.toolkit.auth.reauthenticate: Error: Unable to authenticate connection
-> InvalidClientTokenId: The security token included in the request is invalid. (statusCode: 403; requestId: 00000000-0000-0000-0000-000000000000)
```
I need to mention I can switch to the `Landing` profile with no issues though.
Also, if I install version `3.46.0` I can also switch into the `dev` profile with no issues.
This happens for any with version `>= 3.47.0`
## Steps to reproduce the issue
1. Go to *Extensions* in VSCode
2. Search for AWS Toolkit
3. Uninstall if already installed
4. Click the gear icon and Install Specific Version
5. Select any >= 3.47.0
6. Edit your .aws/config file to include a profile that uses a switch role
7. Sign in using `aws sso login`
8. In VSCode try to switch into the chained profile
## Expected behavior
1. There should be no error
2. AWS Explorer should show `Connected with profile:dev`
## System details (run `AWS: About` and/or `Amazon Q: About`)
- OS: Windows_NT x64 10.0.22621
- Visual Studio Code extension host: 1.98.2
- AWS Toolkit version: >= 3.47.0
- node: 20.18.2
- electron: 34.2.0
Contributor guide
Research direction
Reproduce the failure using the chained profiles in `.aws/config`, after signing in with `aws sso login`, and compare behavior between AWS Toolkit 3.46.0 and 3.47.0 or later. Start from the profile authentication flow reported in the logs and verify that AWS Explorer can connect to `profile:dev` without `InvalidClientTokenId`.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- aws, typescript, vscode
- Domain
- authentication, cloud, devtools
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100