Amazon-ssm-agent: Credentials not updating on Windows due to read-only .aws directory

[omenlabs]

I know that Windows 10 probably isn't a target platform, but everything appears to be working for me except for one thing. The .aws directory is created read-only. This prevents the automatic updating of the credentials file every hour. If I manually remove the read-only attribute, the credentials will update, but .aws will again be read-only. I am not sure if anyone else has run into this or if it is due to a difference in profile/permissions between Windows 10 and Windows Server.

2018-06-21 12:48:36 ERROR [Retrieve @ role_provider.go.145] managedInstancesRoleProviderError occurred sharing credentials. SharedCredentialsStore: failed to save profile caused by: rename C:\WINDOWS\system32\config\systemprofile\.aws\credentials.971110400.tmp C:\WINDOWS\system32\config\systemprofile\.aws\credentials: Access is denied.                                           

I tried running the SSM agent as Administrator and .aws is created read only again:

2018-06-21 13:00:12 ERROR [Retrieve @ role_provider.go.145] managedInstancesRoleProviderError occurred sharing credentials. SharedCredentialsStore: failed to save profile caused by: rename C:\Users\Administrator\.aws\credentials.105282500.tmp C:\Users\Administrator\.aws\credentials: Access is denied.

[JoeTaylor95]

Same here! Tested on two Windows 2016 servers.

[omenlabs]

@JoeTaylor95 After removing the read-only attribute on C:\Users\Administrator\.aws, I was able to get things going, since the attribute is not automatically restored like it is under c:\windows\system32. I used setx to point my interactive user at the credentials, which got boto3 and friends working. IIRC, the command was:

setx AWS_SHARED_CREDENTIALS_FILE C:\Users\Administrator\.aws\credentials

[nford]

I can confirm the issue using the AWS base Windows 2016 AMI. I've opened a support ticket with them.

[omenlabs]

@nford Thank you for the additional info. Title has been updated.

[AmyZhangAmz]

Hi @omenlabs ,

Thank you for bringing this to our attention. We will have the team investigate this issue.

[nehalaws]

The issue has been fixed here 034bed25bcf9d9306bfbc8f09f0263a1ebd92dad