Issue with credential finding algorithm #2387
Assignees
Labels
closed-for-staleness
guidance
Question that needs advice or information.
needs-reproduction
response-requested
Waiting on additional info and feedback.
Comments
kdaily
added
investigating
|
Hi @ryanisnan, With regards to the issues with SSO, I think you're running into this issue: There is a detailed response on the design choices for this already, so I won't duplicate it here: With regard to not getting credentials from the shared credential file, can you provide some debug logs and your example, please? Thanks! |
kdaily
added
guidance
|
I tried to reproduce as well and I was successful with logging in to SSO via the AWS CLI V2 and then using the same profile to access AWS services. Can you provide any further debug logs using |
kdaily
added
response-requested
|
Hey @kdaily thanks for looking into this! Here's what added that logging spits out: I'm not sure why it's trying to make any calls to the metadata API, I'm not on ec2... |
github-actions
bot
removed
the
response-requested
|
Thanks for the debug, I can see that it is skipping over all of the credential methods in the chain, and falling back to IMDS: Have you moved the location of the shared credentials file, or is it in the default location (looks like it should be Can you successfully use any other method, like environment variables, successfully? |
|
Hi Kenneth, my shared credentials file is at the default path. Falling back
on environment variables works, however.
…On Mon, May 17, 2021 at 12:08 PM Kenneth Daily ***@***.***> wrote:
Thanks for the debug, I can see that it is skipping over all of the
credential methods in the chain, and falling back to IMDS:
2021-05-14 17:09:33,508 botocore.credentials [DEBUG] Looking for credentials via: env
2021-05-14 17:09:33,508 botocore.credentials [DEBUG] Looking for credentials via: assume-role
2021-05-14 17:09:33,508 botocore.credentials [DEBUG] Looking for credentials via: assume-role-with-web-identity
2021-05-14 17:09:33,508 botocore.credentials [DEBUG] Looking for credentials via: sso
2021-05-14 17:09:33,508 botocore.credentials [DEBUG] Looking for credentials via: shared-credentials-file
2021-05-14 17:09:33,509 botocore.credentials [DEBUG] Looking for credentials via: custom-process
2021-05-14 17:09:33,509 botocore.credentials [DEBUG] Looking for credentials via: config-file
2021-05-14 17:09:33,510 botocore.credentials [DEBUG] Looking for credentials via: ec2-credentials-file
2021-05-14 17:09:33,510 botocore.credentials [DEBUG] Looking for credentials via: boto-config
2021-05-14 17:09:33,510 botocore.credentials [DEBUG] Looking for credentials via: container-role
2021-05-14 17:09:33,510 botocore.credentials [DEBUG] Looking for credentials via: iam-role
Have you moved the location of the shared credentials file, or is it in
the default location (looks like it should be /Users/ryanwest/.aws from
your debug logs)?
Can you successfully use any other method, like environment variables,
successfully?
—
You are receiving this because you were mentioned.
Reply to this email directly, view it on GitHub
<#2387 (comment)>, or
unsubscribe
<https://github.com/notifications/unsubscribe-auth/AAD3DWIFRTQVVDNLW2K5COTTOFSRTANCNFSM443LN6GA>
.
|
github-actions
bot
removed
the
response-requested
|
Thanks @ryanisnan. I'm not seeing anything obvious.
|
|
Maybe I overlooked something simple. You would need to specify the same profile with a |
kdaily
added
response-requested
|
Greetings! It looks like this issue hasn’t been active in longer than a week. We encourage you to check if this is still an issue in the latest release. Because it has been longer than a week since the last update on this, and in the absence of more information, we will be closing this issue soon. If you find that this is still a problem, please feel free to provide a comment or add an upvote to prevent automatic closure, or if the issue is already closed, please feel free to open a new one. |
github-actions
bot
added
closing-soon
closed-for-staleness
and removed
closing-soon
labels
|
If anyone finds this in the future, my problem was basically what @kdaily last posted - boto3 wasn't using the profile/credentials I was expecting because I hadn't specified any particular profile/credentials. It seems like there's a few simple ways to handle that (I'm sure there's more though):
You could also probably set up your script to accept a profile and use the specified profile when starting the session, but that's a bit out of scope for this comment. The tipoff for me was realizing I also couldn't execute aws cli commands that required authentication (e.g. |
|
I'm ran into this issue as well, with boto3 v 1.26.162 and botocore 1.29.162 and python 3.10. I was using IAM identity center, which stores its config info in I deleted I got it working by adding the To set a default profile so I don't have to use the Problem solved. |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Describe the bug
botocore is unable to locate credentials from either the SSO flow or the shared credentials file methods.
Additional information
The steps below are only for the SSO credential flow, but I also was able to reproduce this bug using the shared credentials file flow. The environment variable method of credential access did work however.
Steps to reproduce
1.17.721.20.72aws sso login --profile deploybotocore.exceptions.NoCredentialsError: Unable to locate credentials(see full stack trace below)Expected behavior
Results should be returned in the event the found credentials have the required permissions, or we get rejected on the basis of insufficient permissions.
Debug logs
The text was updated successfully, but these errors were encountered: