chamber: Chamber is not working with recommended AWS SSO config that uses sso-session
AWS IAM Identity Center (formerly known as AWS SSO) has two ways of being configured. There’s the recommended way that uses sessions with automatic token refresh: https://docs.aws.amazon.com/cli/latest/userguide/sso-configure-profile-token.html And the old legacy way: https://docs.aws.amazon.com/cli/latest/userguide/sso-configure-profile-legacy.html
Chamber works fine with the legacy method, however it does not work with the recommended method.
Legacy:
$ AWS_PROFILE=test chamber list test/common
Key Version LastModified User
aws_account_alias 0 2022-11-17 07:37:30 REDACTED
aws_account_id 0 2022-11-17 07:37:30 REDACTED
Recommended:
$ AWS_PROFILE=test chamber list test/common
Error: Failed to get secret store: profile "test" is configured to use SSO but is missing required configuration: sso_region, sso_start_url
Redacted legacy config in ~/.aws/config
:
[profile test]
region = ap-southeast-2
sso_account_id = 000000000000
sso_region = ap-southeast-2
sso_role_name = ReadOnly
sso_start_url = https://COMPANY.awsapps.com/start
Redacted recommended config in ~/.aws/confg
:
[profile test]
region = ap-southeast-2
sso_account_id = 000000000000
sso_role_name = ReadOnly
sso_session = common
[sso-session common]
sso_region = ap-southeast-2
sso_registration_scopes = sso:account:access
sso_start_url = https://COMPANY.awsapps.com/start
I suspect the fix will be to update the aws-sdk-go dependency
About this issue
- Original URL
- State: closed
- Created a year ago
- Comments: 15 (9 by maintainers)
aws-sdk-go
has an issue raised against it about not supporting the newsso-session
configuration: https://github.com/aws/aws-sdk-go/issues/4649It looks like a pull request to add support to it was raised 3 hours ago: https://github.com/aws/aws-sdk-go/pull/4885
So with any luck, once this is merged and a release of
aws-sdk-go
comes out with it, then upgrading to that should hopefully fix it.@jim-barber-he got it, thanks!
On a whim, do you mind checking out latest
master
, building, and testing out your SSO configuration to see if by chance it was fixed? We just merged in a patch version update toaws-sdk-go
(https://github.com/segmentio/chamber/pull/397) and want to verify if all that is needed here is a new release.All that should be necessary is
make build
in the root of the repo