cli: unable to resolve AWS account to use with CLI with SSO #24744
Comments
astef
added
bug
pahud
changed the title
|
Thank you for your report. Yes I occasionally have this issue as well but I can't find the root cause. I am making it p1 bug here and we probably need more feedback before we can identify the root cause. |
pahud
added
p1
effort/medium
|
Hi Does it work by running: If it does not, can you share your log with For example: You should see logs like this |
corymhall
added
p2
needs-reproduction
|
Having the same issue on like 1/5th of all cdk deploys and it's driving me nuts. Re-run usually works though. |
|
I have the same symptom as mfittko mentioned. ~20% of time, and autoheals after rerun. Error text: The environment is the same, as I posted, but CDK version is now I think it was ok for at least one version between 2.69.0 and 2.79.0 |
|
I have been trying to resolve this for a few hours now and almost tried everything said/suggested in different Github issues and Tickets.
I don't remember spending this much time just for authentication so far in any of the tools. awscli version - aws-cli/2.13.3 Python/3.11.4 Darwin/22.1.0 exe/x86_64 prompt/off CDK was supposed to help me automate things and reduce my load but now am spending lot of time in setting up the CDK itself 👎 😒 |
|
I just wanted to add that in my case, it looks like it has something to do with the browser: When it happens (that my SSO session expired, but randomly seem not to be able to re-login), copy-pasting the URL in another browser and completing the login cycle there seems to solve the problem. |
I have the same results. My SSO session has expired, so I login via the browser again, restart vs code, and everything seems to work. |
|
One possible workaround is to add a script or command to the |
|
I also get the "Unable to resolve AWS account to use" error when my sso session has expired. I am able to fix by running After I can also repro and re-trigger the error simply by running My |
|
ive been using AWS sso temp creds for weeks. not really had an issue till tonight. same issue as described above |
|
I have been getting this issue on multiple systems with various cdk CLI versions and it never disappeared to date. It drove me so nuts, that I have created a command wrapper script that actually ensures that I am logged in as it is using aws cli to retrieve the current profile's account ID. I pass this profile into the cdk command and I am 100% sure that I even set the So I am also setting |
|
I have the same problem. I have 3 different profiles of which 2 are configured with sso and one is my private account and I see this in the logs
I can list my files in my S3 bucket I just want to mention that CDK used to work for me before I configured the two SSO accounts in AWS CLI. Is there a fix for this? I simply cannot deploy my stack to AWS now at all :( |
|
Did you try setting the account id via |
Of course I did and it still doesn't work. I even did |
|
we're still all getting this intermittently when running |
|
I just saw this as well. I restarted my terminal session and everything worked again. |
|
Having the same issues come out of nowhere, running for a week now. Tried all the common suggestions: Still getting the: Here is my Correct me if I'm wrong, but the idea behind this sso-session block above is so you don't input Should also add, I have replicated the exact same setup on a different machine and it works just fine. AWS CLI works fine even where CDK doesn't. Dev Environment: EDIT (fix for users with ESET Security on Windows): Had the notion something must have changed on my work environment, things that have been working for a year don't just break. To those who have been facing CDK https://stackoverflow.com/a/78347970/11131550 |
|
@DimitriosKay try adding a default section with your sso-session set: |
|
@calid I have this in and out at times. Mostly it allows me not to specify a profile on sso login so far. |
|
Hi is there any update on this? None of the workarounds work for me. I don't see this issue all of the time, but once I hit it, I get it consistently. |
|
I built a small ruby based CLI tools and wrapped all my |
|
After this error occurs many times, with And this error occurred again with Does cdk not support even a basic AWS_PROFILE env? |
|
In my case unless I export it explicitly it won't work. |
|
I got the same issue. And I finally solved it by bootstraping CDK, running npx cdk bootstrp aws://${AWS_ACCT_ID}/${AWS_REGION} --profile ${AWS_PROFILE} |
|
Found a solution for me, hope it helps someone: I have both SSO profiles & credentials defined (including default). I deleted (saved elsewhere) the config file contents, and simply placed a single [default] credential in credentials file (using access key format) and then set AWS_PROFILE=default (probably not necessary). Then ran my commands (in my case Amplify Gen 2 (nppx ampx sandbox) command error:> Unable to resolve AWS account to use. It must be either configured when you define e environmentUnable to resolve AWS account to use. It must be either configured when you define your CDK Stack, or through the env Resolution: You can retry your last request as this is most likely a transient issue: https://github.com/aws/aws-cdk/rsists ensure your local AWS credentials are valid. |
|
I'm fairly certain this should have been fixed when we upgraded our AWS SDK to v2.1691.0 because of aws/aws-sdk-js#4443. Can you please upgrade your cdk cli to our most recent version and see if this is still impacting you? If it is, you should see a resolution when #31702 is merged. |
|
I can confirm that this has been fixed for us for a while now, cannot exactly say when and how, but it definitely did not occur any more lately. If so, thanks a lot, this was always pretty annoying! |
otaviomacedo
added
the
response-requested
|
Waiting for more people to confirm the fix before closing the issue. |
github-actions
bot
removed
the
response-requested
This PR updates the CDK CLI to use the AWS SDK V3 instead of V2. ### Manual Test Cases for Authorization All tests were run verbosely so that I could manually check the credentials being used from the CLI output. - [x] No credentials setup and no default profile fails as expected (established to ensure nothing was unintentionally setup) - [x] Explicitly provided profile sourced from config file, tested with both `--profile` and `AWS_PROFILE` - [x] `aws_access_key_id` and `aws_secret_access_key` - [x] `aws_access_key_id` and `aws_secret_access_key` and `region` - [x] `source_profile` and `role_arn` that points to another profile with `aws_access_key_id` and `aws_secret_access_key` in both config and credentials - [x] `source_profile` and `role_arn` that points to Environment - [x] `source_profile` that and `role_arn` that points to SSO profile in both config and credentials - [x] SSO both using all fields in `[profile]` and split between `[sso-session]` and `[profile]` - [x] `credential_source` is Environment - [x] `credential_process` - [x] Explicitly provided profile sourced from credentials file - [x] `aws_access_key_id` and `aws_secret_access_key` - [x] `aws_access_key_id` and `aws_secret_access_key` and `region` - [x] `source_profile` and `role_arn` that points to another profile with `aws_access_key_id` and `aws_secret_access_key` in both config and credentials - [x] `source_profile` and `role_arn` that points to Environment - [x] `source_profile` that and `role_arn` that points to SSO profile in both config and credentials - [x] `credential_source` is Environment - [x] `credential_source` is EcsContainer (integ tests in CodeBuild) - [x] `credential_process` - [x] Default profile (in both config file and credentials file) - [x] `AWS_ACCESS_KEY_ID` and `AWS_SECRET_ACCESS_KEY` environment variables set (cleared after test) - [x] `AMAZON_ACCESS_KEY_ID` and `AMAZON_SECRET_ACCESS_KEY` environment variables set (cleared after test) - [x] `aws_access_key_id` and `aws_secret_access_key` - [x] `aws_access_key_id` and `aws_secret_access_key` and `region` - [x] `source_profile` and `role_arn` that points to a profile with `aws_access_key_id` and `aws_secret_access_key` - [x] `source_profile` and `role_arn` that points to Environment (this will use `fromEnv` prior to getting to looking for `source_profile` in the Ini file) - [x] SSO profile is setup as default - [x] `credential_process` Closes #25870, #26292, #20956, #24744, #27265, 20896. ### Reason for this change The AWS SDK V2 is now in maintenance mode. ---- *By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license* --------- Co-authored-by: Otavio Macedo <[email protected]> Co-authored-by: Rico Huijbers <[email protected]>
This PR updates the CDK CLI to use the AWS SDK V3 instead of V2. ### Manual Test Cases for Authorization All tests were run verbosely so that I could manually check the credentials being used from the CLI output. - [x] No credentials setup and no default profile fails as expected (established to ensure nothing was unintentionally setup) - [x] Explicitly provided profile sourced from config file, tested with both `--profile` and `AWS_PROFILE` - [x] `aws_access_key_id` and `aws_secret_access_key` - [x] `aws_access_key_id` and `aws_secret_access_key` and `region` - [x] `source_profile` and `role_arn` that points to another profile with `aws_access_key_id` and `aws_secret_access_key` in both config and credentials - [x] `source_profile` and `role_arn` that points to Environment - [x] `source_profile` that and `role_arn` that points to SSO profile in both config and credentials - [x] SSO both using all fields in `[profile]` and split between `[sso-session]` and `[profile]` - [x] `credential_source` is Environment - [x] `credential_process` - [x] Explicitly provided profile sourced from credentials file - [x] `aws_access_key_id` and `aws_secret_access_key` - [x] `aws_access_key_id` and `aws_secret_access_key` and `region` - [x] `source_profile` and `role_arn` that points to another profile with `aws_access_key_id` and `aws_secret_access_key` in both config and credentials - [x] `source_profile` and `role_arn` that points to Environment - [x] `source_profile` that and `role_arn` that points to SSO profile in both config and credentials - [x] `credential_source` is Environment - [x] `credential_source` is EcsContainer (integ tests in CodeBuild) - [x] `credential_process` - [x] Default profile (in both config file and credentials file) - [x] `AWS_ACCESS_KEY_ID` and `AWS_SECRET_ACCESS_KEY` environment variables set (cleared after test) - [x] `AMAZON_ACCESS_KEY_ID` and `AMAZON_SECRET_ACCESS_KEY` environment variables set (cleared after test) - [x] `aws_access_key_id` and `aws_secret_access_key` - [x] `aws_access_key_id` and `aws_secret_access_key` and `region` - [x] `source_profile` and `role_arn` that points to a profile with `aws_access_key_id` and `aws_secret_access_key` - [x] `source_profile` and `role_arn` that points to Environment (this will use `fromEnv` prior to getting to looking for `source_profile` in the Ini file) - [x] SSO profile is setup as default - [x] `credential_process` Closes #25870, #26292, #20956, #24744, #27265, 20896. ### Reason for this change The AWS SDK V2 is now in maintenance mode. ---- *By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license* --------- Co-authored-by: Otavio Macedo <[email protected]> Co-authored-by: Rico Huijbers <[email protected]> (cherry picked from commit 5bc0662)
|
Comments on closed issues and PRs are hard for our team to see. |
Describe the bug
Approximately in 25% of
npx cdk deploy --all --require-approval neverruns, I'm getting this error:I've started to experience this after changing my env to the following:
~/.aws/config
~/.aws/credentials - empty file
~/.zshrc
This setup works perfectly for me, because I can switch profiles with only
AWS_DEFAULT_PROFILEenv variable. AWS SDK understands it and works perfectly.For whatever reason, CDK tool sometimes fails in the middle of the deployment. After repeating the same command immediately, it succeeds.
Expected Behavior
Not to fail.
Current Behavior
Failure (sometimes)
Reproduction Steps
Didn't do, but I'm seeing this in different totally independent projects on same machine.
Possible Solution
No response
Additional Information/Context
No response
CDK CLI Version
2.69.0 (build 60a5b2a)
Framework Version
No response
Node.js Version
v16.19.1
OS
macOS Ventura 13.2.1
Language
Typescript
Language Version
TypeScript (4.9.5)
Other information
No response
The text was updated successfully, but these errors were encountered: