jorgebastida / jorgebastida/awslogs

RefreshWithMFAUnsupportedError: Cannot refresh credentials: MFA token required.

Open
#283 0 comments 0 reactions 0 assignees View on GitHub
Dominant language
Python
Stars
5k
Forks
342
PR merge metrics
No merged PRs in 30d

Description

Awslogs may crash if MFA credentials expire while it is getting a large log stream.

Trace:

```
Version: 0.12.0
Python: 3.7.3 (default, Mar 27 2019, 09:23:32)
[Clang 9.0.0 (clang-900.0.39.2)]
boto3 version: 1.10.45
Platform: Darwin-16.7.0-x86_64-i386-64bit
Args: ['/usr/local/bin/awslogs', 'get', '', '', '-s', '52 weeks ago']
Config: {'aws_access_key_id': 'SENSITIVE',
'aws_profile': 'SENSITIVE',
'aws_region': None,
'aws_secret_access_key': 'SENSITIVE',
'aws_session_token': 'SENSITIVE',
'color': 'auto',
'end': None,
'filter_pattern': None,
'func': 'list_logs',
'log_group_name': '',
'log_stream_name': '',
'output_group_enabled': True,
'output_ingestion_time_enabled': False,
'output_stream_enabled': True,
'output_timestamp_enabled': False,
'query': None,
'start': '52 weeks ago',
'watch': False,
'watch_interval': 1}

Traceback (most recent call last):
File "/usr/local/lib/python3.7/site-packages/awslogs-0.12.0-py3.7.egg/awslogs/bin.py", line 178, in main
getattr(logs, options.func)()
File "/usr/local/lib/python3.7/site-packages/awslogs-0.12.0-py3.7.egg/awslogs/core.py", line 223, in list_logs
consumer()
File "/usr/local/lib/python3.7/site-packages/awslogs-0.12.0-py3.7.egg/awslogs/core.py", line 164, in consumer
for event in generator():
File "/usr/local/lib/python3.7/site-packages/awslogs-0.12.0-py3.7.egg/awslogs/core.py", line 151, in generator
response = self.client.filter_log_events(**kwargs)
File "/usr/local/lib/python3.7/site-packages/botocore-1.13.45-py3.7.egg/botocore/client.py", line 276, in _api_call
return self._make_api_call(operation_name, kwargs)
File "/usr/local/lib/python3.7/site-packages/botocore-1.13.45-py3.7.egg/botocore/client.py", line 573, in _make_api_call
operation_model, request_dict, request_context)
File "/usr/local/lib/python3.7/site-packages/botocore-1.13.45-py3.7.egg/botocore/client.py", line 592, in _make_request
return self._endpoint.make_request(operation_model, request_dict)
File "/usr/local/lib/python3.7/site-packages/botocore-1.13.45-py3.7.egg/botocore/endpoint.py", line 102, in make_request
return self._send_request(request_dict, operation_model)
File "/usr/local/lib/python3.7/site-packages/botocore-1.13.45-py3.7.egg/botocore/endpoint.py", line 132, in _send_request
request = self.create_request(request_dict, operation_model)
File "/usr/local/lib/python3.7/site-packages/botocore-1.13.45-py3.7.egg/botocore/endpoint.py", line 116, in create_request
operation_name=operation_model.name)
File "/usr/local/lib/python3.7/site-packages/botocore-1.13.45-py3.7.egg/botocore/hooks.py", line 356, in emit
return self._emitter.emit(aliased_event_name, **kwargs)
File "/usr/local/lib/python3.7/site-packages/botocore-1.13.45-py3.7.egg/botocore/hooks.py", line 228, in emit
return self._emit(event_name, kwargs)
File "/usr/local/lib/python3.7/site-packages/botocore-1.13.45-py3.7.egg/botocore/hooks.py", line 211, in _emit
response = handler(**kwargs)
File "/usr/local/lib/python3.7/site-packages/botocore-1.13.45-py3.7.egg/botocore/signers.py", line 90, in handler
return self.sign(operation_name, request)
File "/usr/local/lib/python3.7/site-packages/botocore-1.13.45-py3.7.egg/botocore/signers.py", line 152, in sign
auth = self.get_auth_instance(**kwargs)
File "/usr/local/lib/python3.7/site-packages/botocore-1.13.45-py3.7.egg/botocore/signers.py", line 232, in get_auth_instance
frozen_credentials = self._credentials.get_frozen_credentials()
File "/usr/local/lib/python3.7/site-packages/botocore-1.13.45-py3.7.egg/botocore/credentials.py", line 591, in get_frozen_credentials
self._refresh()
File "/usr/local/lib/python3.7/site-packages/botocore-1.13.45-py3.7.egg/botocore/credentials.py", line 486, in _refresh
self._protected_refresh(is_mandatory=is_mandatory_refresh)
File "/usr/local/lib/python3.7/site-packages/botocore-1.13.45-py3.7.egg/botocore/credentials.py", line 502, in _protected_refresh
metadata = self._refresh_using()
File "/usr/local/lib/python3.7/site-packages/botocore-1.13.45-py3.7.egg/botocore/credentials.py", line 248, in __call__
raise RefreshWithMFAUnsupportedError()
botocore.exceptions.RefreshWithMFAUnsupportedError: Cannot refresh credentials: MFA token required.
```

Contributor guide

No contributing guide indexed for this repository

Research direction

Start with awslogs/core.py's consumer and generator around the filter_log_events call shown in the trace, using the reported long-stream scenario to investigate credential expiry. Check awslogs/bin.py's main path for how the exception reaches the CLI. Done means the MFA-expiry case has defined, tested behavior without an unhandled crash.

Written by the indexing model from the issue text.

Assessment

Tech stack
aws, python
Domain
authentication, cli, cloud
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Needs clarification
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.