AWS auth does not work as per instructions

[awslabs]

AWS auth does not work as per instructions

[StoneDot]

Currently, dynein uses rusoto to load AWS credentials. And it seems that you use aws-azure-login. It looks like that aws-azure-login generates ~/.aws/credentials as described on docs.

It lets you use the normal Azure AD login (including MFA) from a command line to create a federated AWS session and places the temporary credentials in the proper place for the AWS CLI and SDKs.

Could you check if your ~/.aws/credentials is created correctly?

[wahlfeld10x]

Currently, dynein uses rusoto to load AWS credentials. And it seems that you use aws-azure-login. It looks like that aws-azure-login generates ~/.aws/credentials as described on docs.

It lets you use the normal Azure AD login (including MFA) from a command line to create a federated AWS session and places the temporary credentials in the proper place for the AWS CLI and SDKs.

Could you check if your ~/.aws/credentials is created correctly?

Sure, see below. It looks okay to me.

> aws-azure-login --profile <redacted> --no-prompt

Logging in with profile '<redacted>'...
Using AWS SAML endpoint https://signin.aws.amazon.com/saml
Assuming role arn:aws:iam::<redacted>:role/<redacted>

> cat $HOME/.aws/credentials | grep <redacted> -A 4

aws_access_key_id=<redacted>
aws_secret_access_key=<redacted>
aws_session_token="<redacted>"
aws_expiration=2022-09-19T02:31:30.000Z

[wahlfeld10x]

I've just gotten it working. It seems dy doesn't work when using source_profile. E.g.

> aws-azure-login --profile foo --no-prompt
Logging in with profile 'foo'...
Using AWS SAML endpoint https://signin.aws.amazon.com/saml
Assuming role arn:aws:iam::123/foo

> export AWS_PROFILE=foo

> dy ls
(works)

~/.aws/config
[profile bar]
source_profile=foo
role_arn=arn:aws:iam::123:role/foo
[email protected]
region=eu-west-1

> export AWS_PROFILE=bar

> dy ls
(doesn't work)

[StoneDot]

It makes sense. It seems that rusoto does not support source_profile. See the issue for detail. Additionally, it looks like that AWS SDK for Rust support source_profile. Thus, to support your use-case, we should change codes to use AWS SDK for Rust instead of rusoto. The update to AWS SDK for Rust is tracked by #51.

I will close this issue because we determined the root cause, which should be treated as a feature request of #51. Please feel free to reopen if you have any concerns regarding this issue.

[wahlfeld10x]

It makes sense. It seems that rusoto does not support source_profile. See the issue for detail. Additionally, it looks like that AWS SDK for Rust support source_profile. Thus, to support your use-case, we should change codes to use AWS SDK for Rust instead of rusoto. The update to AWS SDK for Rust is tracked by #51.

I will close this issue because we determined the root cause, which should be treated as a feature request of #51. Please feel free to reopen if you have any concerns regarding this issue.

OK thanks for explaining that. The issue you linked is nearly 3 years old ... is there any ETA from AWS to support this?

[StoneDot]

There is no ETA currently because AWS SDK for Rust is still developer preview. Unfortunately, we don't have enough bandwidth to support both SDK at the time.