pulumi-aws: Cannot authenticate on AWS using switchrole

~/.aws/credentials is populated with account profiles like this

[profile-admin]
aws_access_key_id=redact
aws_secret_access_key=redact
aws_session_token=redact

Have tried setting env var for export AWS_PROFILE=profile-admin to this as well as setting pulumi config set aws:profile profile-admin individually and separately and get the error posted in prior message.

The only way I’ve been able to get anything to work is to set all three ENV variables:

AWS_ACCESS_KEY_ID
AWS_SECRET_ACCESS_KEY
AWS_SESSION_TOKEN

while this is feasible for a POC it is not very scalable. I would have expected the recommended settings of the ENV variable pulumi config setting to work fully on their own.

We use OneLogin to authenticate SSO and create sessions with temporary keys so the three tokens would have to be changed every time you setup a new session.

My environment is Ubuntu on WSL, have setup and used terraform with AWS profiles and can use profiles directly from python using boto3.setup_default_session calls.

If there is more detail you’d like please let me know and will try to specify

With the setup below - things work.

In ~/.aws/credentials:

[pulumi-token]
aws_access_key_id = <redacted>
aws_secret_access_key = <redacted>
aws_session_token = <redacted>

In ~/.aws/config:

[profile staging-token]
role_arn=arn:aws:iam::<redacted>:role/OrganizationAccountAccessRole
source_profile=pulumi-token
region=us-west-2

In Pulumi.<stack>.yaml:

config:
  aws:profile: staging-token
  aws:region: us-west-2

Results:

$ pulumi up
Previewing update (staging):

     Type                 Name                Plan       
 +   pulumi:pulumi:Stack  assumerole-staging  create     
 +   └─ aws:s3:Bucket     my-bucket           create     
 
Resources:
    + 2 to create

Do you want to perform this update? yes
Updating (staging):

     Type                 Name                Status      
 +   pulumi:pulumi:Stack  assumerole-staging  created     
 +   └─ aws:s3:Bucket     my-bucket           created     
 
Outputs:
    bucketName: "my-bucket-77c7547"

Resources:
    + 2 created

Duration: 1m27s

However, if I remove the aws:profile setting and instead set the AWS_PROFILE env var I can reproduce:

  aws:s3:Bucket (my-bucket):
    error: unable to discover AWS AccessKeyID and/or SecretAccessKey - see https://pulumi.io/install/aws.html for details on configuration

I presume that provides a workaround for anyone hitting this (use pulumi config set aws:profile <profile>), though we should also fix the AWS_PROFILE env var support.

Are there any other configurations folks have that are also hitting this error?

@joeduffy I had the same problem and after reading your comment I just created a new aws profile for pulumi and copied the remaining lines from the source profile into it. Then it worked. Thanks!

Also keep in mind that the other issue #584 leaves the impression that it does not work at all with MFA tokens.

We use AssumeRole as well. I’d like to cast my vote for supporting the aws:profile configuration setting.

@geof2001 would love anymore details you can share on your setup. The usage pattern you describe is definitely supported in general, and used by many/most Pulumi users on AWS - so I expect there is some other more subtle twist on the scenario in your environment. Without sharing any sensitive data - can you share details of how you have your profile configured?

Can you try setting AWS_SDK_LOAD_CONFIG=1 in addition to setting AWS_PROFILE? The underlying provider uses the AWS GO SDK and it does not read ~/.aws/config by default. I would be interested in knowing it that works.

If it does, I wonder if this is just something we should be setting ourselves in some cases, as this is surprising behavior.