Unable to launch stack using AWS CLI v2 and SSO

[tblakers]

Apologies if I'm missing something obvious here.

I use aws configure sso to obtain temporary credentials that allow me to assume a role in an account. The output of that is a temporary profile which I can use with the AWS CLI.

e.g. aws --profile AWSAdministratorAccess-123123123123 s3 ls

When I put this into the profile property in the config.yaml, I get this error:

[2020-05-19 14:38:39] - No cloudformation client found, creating one...
[2020-05-19 14:38:39] - Getting Boto3 session
[2020-05-19 14:38:39] - No Boto3 session found, creating one...
[2020-05-19 14:38:39] - Using cli credentials...
"Session credentials were not found. Profile: AWSAdministratorAccess-123123123123. Region: ap-southeast-2."

Adding the arn of the role I assumed via SSO to the role_arn property doesn't seem to help. I have ensured AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY, AWS_SESSION_TOKEN are unset.

Looking at the source code:

                self.logger.debug("No Boto3 session found, creating one...")
                self.logger.debug("Using cli credentials...")

                # Credentials from env take priority over profile
                config = {
                    "profile_name": profile,
                    "region_name": region,
                    "aws_access_key_id": environ.get("AWS_ACCESS_KEY_ID"),
                    "aws_secret_access_key": environ.get("AWS_SECRET_ACCESS_KEY"),
                    "aws_session_token": environ.get("AWS_SESSION_TOKEN")
                }

                session = boto3.session.Session(**config)
                self._boto_sessions[key] = session

                if session.get_credentials() is None:
                    raise InvalidAWSCredentialsError(
                        "Session credentials were not found. Profile: {0}. Region: {1}.".format(
                            config["profile_name"], config["region_name"]
                        )
                    )

Seems that Boto3 isn't returning anything, and I notice the version sceptre uses is 1.X. Am I correct in understanding that this won't be supported by Sceptre until Boto add support? e.g. boto/boto3#2091 ?

[zaro0508]

I believe you are correct @tblakers, sceptre uses boto3 and boto3 does not support SSO profiles. There does seem to be a workaround that should work with sceptre in the issue you referenced

[ngfgrant]

Hey @tblakers thanks for raising the issue. Yeh we won't support this until Boto support it. Closing for now as there is little we can do!