Cannot authenticate on AWS using switchrole #252
Comments
|
Can you try setting If it does, I wonder if this is just something we should be setting ourselves in some cases, as this is surprising behavior. |
|
Hello Matt, Thanks for the answer, I tried enabling that option but encountered a That's when using the profile in my Anyway, in my opinion, I think it would be best to check the content of both files by default. Thanks |
|
@jen20 just offered to help track this down, so reassigning. |
|
Hi @jnancel! Sorry for the delay in replying here. I committed an example of using AssumeRole to the I'll close out this issue for now since there is a way to do this - please feel free to comment further if you think this doesn't address your requirements though and we'll take another look! |
|
@jen20 That example shows how to use an assumed role programmatically from within Pulumi. But do we know why the steps @jnancel tried don' work? Is it expected that setting |
|
Re-opening. I hit this again recently myself, and was able to work around via an approach like the example, but as expected to just be able to set the profile externally. |
|
This has come up from users several times - I'd love to nail down any remaining issues here and document the expected modes that work. |
|
I've just run into a strikingly similar issue. I have the following setup: When using the |
|
We use |
|
+1 for native role assumption for the CLI tools based on AWS_PROFILE, aws:profile, and other profile setting methods. it's a significant blocker to not support that for any kind of modern multi account setup. eshamay's setup is pretty typical (and may also include an MFA component), and the aws cli tools handle this smoothly now, but pulumi just does: |
|
Can anyone summarize the remaining work here for me, or is the issue that nobody knows? Unfortunately, I'm a noob in the fascinating world of AWS IAM, so I may need some hand-holding here. |
|
I am seeing this issue as well, and I swore it worked once upon a time. |
|
@cleverguy25 which issue specifically are you hitting? (This GitHub issue has unfortunately tracked 3 different things in its lifetime). |
|
Context, I am using WSL on windows. I am logged on to our bastian account, and doing the whole source profile thing to assume a role in another account. AWS cli works, but pulumi gives me this error: Error: Invoke of 'aws:secretsmanager/getSecretVersion:getSecretVersion' failed: rpc error: code = Unknown desc = invocation of aws:secretsmanager/getSecretVersion:getSecretVersion returned an error: unable to discover AWS AccessKeyID and/or SecretAccessKey - see https://pulumi.io/install/aws.html for details on configuration () |
|
With the setup below - things work. In In In config:
aws:profile: staging-token
aws:region: us-west-2Results: However, if I remove the I presume that provides a workaround for anyone hitting this (use Are there any other configurations folks have that are also hitting this error? |
For both programmatic access, and for pre configuration, we must read in all the appropriate env vars. Fixes #252
For both programmatic access, and for pre configuration, we must read in all the appropriate env vars. Fixes #252
For both programmatic access, and for pre configuration, we must read in all the appropriate env vars. Fixes #252
For both programmatic access, and for pre configuration, we must read in all the appropriate env vars. Fixes #252
For both programmatic access, and for pre configuration, we must read in all the appropriate env vars. Fixes #252
|
New to pulumi and have tried having both aws:profile set in Pulumi. |
|
@geof2001 would love anymore details you can share on your setup. The usage pattern you describe is definitely supported in general, and used by many/most Pulumi users on AWS - so I expect there is some other more subtle twist on the scenario in your environment. Without sharing any sensitive data - can you share details of how you have your profile configured? |
|
~/.aws/credentials is populated with account profiles like this Have tried setting env var for The only way I've been able to get anything to work is to set all three ENV variables: while this is feasible for a POC it is not very scalable. I would have expected the recommended settings of the ENV variable pulumi config setting to work fully on their own. We use OneLogin to authenticate SSO and create sessions with temporary keys so the three tokens would have to be changed every time you setup a new session. My environment is Ubuntu on WSL, have setup and used terraform with AWS profiles and can use profiles directly from python using boto3.setup_default_session calls. If there is more detail you'd like please let me know and will try to specify |
infin8x
added
the
p1
|
is there any update for this? |
|
I had same issue with AWS CLI configured. The reason was Removing |
|
[EDIT] Sorry for the noise, my issue seems to be related to pulumi/pulumi-eks#647. Hello @lukehoban, I’m using this small example in go and when I do a Additional informations |
and others
Hello,
I'm trying to bootstrap my first pulumi project but I'm encountering an issue with the supported authentication method on AWS.
If I'm using a profile in which my credentials are defined ( with
aws_access_key_idandaws_secret_access_key), it works like a charm. But that's not how we work in my company, we have a source account and we're using switchrole to jump from that source account to all other accouts ( this is standard AWS procedure when you're dealing with multiple accounts ).Here's the look of my profiles in
~/.aws/config:Now when I'm using one of those profile, it fails :
When using the same command line with my source profile ( the one with the keys ), I have the expected result :
Is there any configuration I'm missing or is it not possible for the moment to use an AWS profile with switchrole ?
Thanks
The text was updated successfully, but these errors were encountered: