AWS_SESSION_TOKEN is ignored resulting in UnauthorizedOperation
- Dominant language
- Python
- Stars
- 7.3k
- Forks
- 780
- PR merge metrics
- No merged PRs in 30d
Description
# summary
aws-shell doesn't seem to read the AWS_SESSION_TOKEN from the envs.
I recently switched to MFA for CLI which now prevents me to use aws-shell.
# AWS configuration
* aws server side details
* a main account with my user
* a secondary account to be accessed using an assumed role that enforce MFA
* .aws/config
```
[default]
region = eu-west-1
output = json
[profile dev]
role_arn =
credential_source = Environment
region = eu-west-1
output = json
```
* environment
```
$ env | grep AWS
AWS_SESSION_TOKEN=
AWS_SECRET_ACCESS_KEY=
AWS_ACCESS_KEY_ID=
```
# Actual behaviour
```
$ aws-shell --profile dev
aws> ec2 describe-instances
An error occurred (UnauthorizedOperation) when calling the DescribeInstances operation: You are not authorized to perform this operation.
```
> same issue using `.profile`
```
$ aws-shell
aws> .profile dev
Current shell profile changed to: dev
aws> ec2 describe-instances
An error occurred (UnauthorizedOperation) when calling the DescribeInstances operation: You are not authorized to perform this operation.
aws>
```
# Expected behaviour
```
$ aws-shell --profile dev
aws> ec2 describe-instances
{
"Reservations": []
}
```
# Debug using aws cli
```
$ aws --profile dev ec2 describe-instances
{
"Reservations": []
}
```
# Steps to reproduce
* enable MFA on an assumed role
* get temporary token using `aws sts get-session-token --serial-number arn:aws:iam:::mfa/ --token-code `
* store them in ENV and configure profile credential source to be Environment
Contributor guide
Research direction
Start by reproducing the difference between `aws-shell --profile dev` and `aws --profile dev ec2 describe-instances` using the environment variables and profile configuration shown. Trace how aws-shell obtains credentials for the selected profile, then verify that the same session-token setup produces the expected successful response.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- aws, python
- Domain
- authentication, cli, cloud
- Issue type
- Bug
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 45/100