chamber: Chamber is not working with recommended AWS SSO config that uses sso-session

AWS IAM Identity Center (formerly known as AWS SSO) has two ways of being configured. There’s the recommended way that uses sessions with automatic token refresh: https://docs.aws.amazon.com/cli/latest/userguide/sso-configure-profile-token.html And the old legacy way: https://docs.aws.amazon.com/cli/latest/userguide/sso-configure-profile-legacy.html

Chamber works fine with the legacy method, however it does not work with the recommended method.

Legacy:

$ AWS_PROFILE=test chamber list test/common
Key					Version		LastModified		User
aws_account_alias			0		2022-11-17 07:37:30	REDACTED
aws_account_id				0		2022-11-17 07:37:30	REDACTED

Recommended:

$ AWS_PROFILE=test chamber list test/common
Error: Failed to get secret store: profile "test" is configured to use SSO but is missing required configuration: sso_region, sso_start_url

Redacted legacy config in ~/.aws/config:

[profile test]
region = ap-southeast-2
sso_account_id = 000000000000
sso_region = ap-southeast-2
sso_role_name = ReadOnly
sso_start_url = https://COMPANY.awsapps.com/start

Redacted recommended config in ~/.aws/confg:

[profile test]
region = ap-southeast-2
sso_account_id = 000000000000
sso_role_name = ReadOnly
sso_session = common

[sso-session common]
sso_region = ap-southeast-2
sso_registration_scopes = sso:account:access
sso_start_url = https://COMPANY.awsapps.com/start

I suspect the fix will be to update the aws-sdk-go dependency

About this issue

  • Original URL
  • State: closed
  • Created a year ago
  • Comments: 15 (9 by maintainers)

Most upvoted comments

aws-sdk-go has an issue raised against it about not supporting the new sso-session configuration: https://github.com/aws/aws-sdk-go/issues/4649

It looks like a pull request to add support to it was raised 3 hours ago: https://github.com/aws/aws-sdk-go/pull/4885

So with any luck, once this is merged and a release of aws-sdk-go comes out with it, then upgrading to that should hopefully fix it.

@jim-barber-he got it, thanks!

On a whim, do you mind checking out latest master, building, and testing out your SSO configuration to see if by chance it was fixed? We just merged in a patch version update to aws-sdk-go (https://github.com/segmentio/chamber/pull/397) and want to verify if all that is needed here is a new release.

All that should be necessary is make build in the root of the repo