Aws-cli: Connection was refused

[kuppurao]

$ aws --version
aws-cli/1.16.89 Python/2.7.10 Darwin/16.7.0 botocore/1.12.79

---

$ aws secretsmanager list-secrets

Connection was closed before we received a valid response from endpoint URL: "https://secretsmanager.us-east-1.amazonaws.com/".

---

[justnance]

@kuppurao - Thanks for reaching out. It looks like you are using a CLI version that supports secretsmanager commands. Would it be possible to provide the debug logs so I can dig a little deeper into the problem? Please append --debug to the command and reply with the sanitized output:

aws secretsmanager list-secrets --debug

Also, this command requires credentials that have permissions to access your secret. The IAM permission required are secretsmanager:ListSecrets. Are the correct IAM permissions in use?

[justnance]

@kuppurao - Secrets Manager, by default, only accepts requests from hosts that use the open standard Transport Layer Security (TLS) and Perfect Forward Secrecy. This helps ensure that your secret is also encrypted while it's in transit between AWS and the computers that you use to retrieve the secret.

I have a hunch this might be related to using Python/2.7.10 and OpenSSL. This API might require newer versions of openssl due to TLS requirements. Try installing a newer version of openssl & python. As per our service team, MacOS Sierra (OpenSSL 0.9.8zh 14 Jan 2016) is incompatible with the secretsmanager endpoint. As such, if the awscli is installed against the system installed Python 2.7.x and OpenSSL, it may fail with a connection reset error. The recommendation is to upgrade to at least Python/2.7.15 if you do not want to upgrade to Python 3.

https://www.python.org/downloads/mac-osx/
https://www.python.org/downloads/release/python-2715/
related github #3806 #3688 #3327

Let us know if there are any other questions.

[kuppurao]

Thank you Nancy. I updated Py to 2.7.15 and it solved the issue.