awslabs / awslabs/aws-shell

AWS_SESSION_TOKEN is ignored resulting in UnauthorizedOperation

Open
#212 3 comments 0 reactions 0 assignees View on GitHub
Dominant language
Python
Stars
7.3k
Forks
780
PR merge metrics
No merged PRs in 30d

Description

# summary
aws-shell doesn't seem to read the AWS_SESSION_TOKEN from the envs.

I recently switched to MFA for CLI which now prevents me to use aws-shell.

# AWS configuration

* aws server side details
* a main account with my user
* a secondary account to be accessed using an assumed role that enforce MFA

* .aws/config
```
[default]
region = eu-west-1
output = json
[profile dev]
role_arn =
credential_source = Environment
region = eu-west-1
output = json
```
* environment
```
$ env | grep AWS
AWS_SESSION_TOKEN=
AWS_SECRET_ACCESS_KEY=
AWS_ACCESS_KEY_ID=
```

# Actual behaviour
```
$ aws-shell --profile dev
aws> ec2 describe-instances

An error occurred (UnauthorizedOperation) when calling the DescribeInstances operation: You are not authorized to perform this operation.
```

> same issue using `.profile`

```
$ aws-shell
aws> .profile dev
Current shell profile changed to: dev
aws> ec2 describe-instances

An error occurred (UnauthorizedOperation) when calling the DescribeInstances operation: You are not authorized to perform this operation.
aws>
```

# Expected behaviour

```
$ aws-shell --profile dev
aws> ec2 describe-instances
{
"Reservations": []
}
```

# Debug using aws cli
```
$ aws --profile dev ec2 describe-instances
{
"Reservations": []
}
```

# Steps to reproduce
* enable MFA on an assumed role
* get temporary token using `aws sts get-session-token --serial-number arn:aws:iam:::mfa/ --token-code `
* store them in ENV and configure profile credential source to be Environment

Contributor guide

Open the contributing guide

Research direction

Start by reproducing the difference between `aws-shell --profile dev` and `aws --profile dev ec2 describe-instances` using the environment variables and profile configuration shown. Trace how aws-shell obtains credentials for the selected profile, then verify that the same session-token setup produces the expected successful response.

Written by the indexing model from the issue text.

Assessment

Tech stack
aws, python
Domain
authentication, cli, cloud
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
45/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.