Aws-cli: Deploy with cloudformation fails from awscli >= 1.16.210

[barroca]

I have a Dockerfile that installs awscli and deploys my application. If I use versions >= 1.16.210 the deployment fails with the message Credential named assume-role-with-web-identity not found. This is related to the issue #4371 that is claimed to be fixed but it isn't

It could be related to botocore, but in this case is needed to force the dependency on awscli.

I've tested with all versions and the latest release that is working properly is 1.16.209

[8848mzy]

+1 Please revert the current version, I can't use cli now

[otrapeznikov]

+1
On initial installation with awscli==1.16.212 and botocore==1.12.202 getting the same error. Works after downgrading to botocore==1.12.201.

If upgraded again to botocore==1.12.202, issue doesn't appear.

[tinyzimmer]

+1. I've tried all the recommended botocore versions in this thread and the referenced, closed one, and the issue still persists when I try to get an ECR login.

EDIT: FWIW Switching to python2 and using latest available worked.

[gaffney]

Updating to boto3 1.9.206 & botocore 1.12.206 fixed this issue (python3)

[stealthycoin]

The current version works fine in a fresh virtualenv packaging and deploying a template with cloudformation. Many things could be happening if you are not installing into a fresh virtualenvironment, or are installing anything after the CLI that takes a dependency on a different version of botocore than the CLI does. Switching to python 2 has nothing at all to do with this issue so that is a definite sign that your python environments are not properly isolated. It likely fixed the issue just by virtue of being a different environment. The CLI locks to a specific version of botocore, if you have a different one than it specifies, there is no guarantee that it will work properly. I've also verified that 1.16.212/1.12.202 work as well.

@barroca I would need a lot more details about your dockerfile, and specifically how you are installing the CLI. And what else is in that environment (pip freeze output) since I have verified at least that all the versions work fine in new environments, it is likely something in your env that is messed up. The other comments here back that up since they all got the issue fixed doing things to their environment, or switching environments.

[thapakazi]

I had the same error msg while running aws s3 ls but its solve for me now.
I somehow installed botocore as --user earlier, I don't remember though...which caused me this.

awscli works fine with the latest version now:

aws --version                                                                     
aws-cli/1.16.219 Python/3.7.4 Linux/5.1.15-arch1-1-ARCH botocore/1.12.209

It seems I had messed up the installation of botocore, as both _sudo_ and as _--user_. Removing it from my user, and updating awscli & boto to latest version, solved it for me.

aws s3 ls --debug                                                                                                   /usr/lib/python3.7/site-packages
2019-08-16 12:35:49,194 - MainThread - awscli.clidriver - DEBUG - CLI version: aws-cli/1.16.219 Python/3.7.3 Linux/5.1.15-arch1-1-ARCH botocore/1.12.199
2019-08-16 12:35:49,195 - MainThread - awscli.clidriver - DEBUG - Arguments entered to CLI: ['s3', 'ls', '--debug']
2019-08-16 12:35:49,195 - MainThread - botocore.hooks - DEBUG - Event session-initialized: calling handler <function add_scalar_parsers at 0x7f5d4059a0d0>
2019-08-16 12:35:49,195 - MainThread - botocore.hooks - DEBUG - Event session-initialized: calling handler <function register_uri_param_handler at 0x7f5d40a6de18>
2019-08-16 12:35:49,196 - MainThread - botocore.hooks - DEBUG - Event session-initialized: calling handler <function inject_assume_role_provider_cache at 0x7f5d409ce8c8>
2019-08-16 12:35:49,201 - MainThread - awscli.clidriver - DEBUG - Exception caught in main()
Traceback (most recent call last):
  File "/home/thapakazi/.pip/lib/python3.7/site-packages/botocore/credentials.py", line 1735, in _get_provider_offset
    return [p.METHOD for p in self.providers].index(name)
ValueError: 'assume-role-with-web-identity' is not in list

During handling of the above exception, another exception occurred:

Traceback (most recent call last):
  File "/usr/lib/python3.7/site-packages/awscli/clidriver.py", line 213, in main
    self._emit_session_event(parsed_args)
  File "/usr/lib/python3.7/site-packages/awscli/clidriver.py", line 253, in _emit_session_event
    parsed_args=parsed_args)
  File "/home/thapakazi/.pip/lib/python3.7/site-packages/botocore/session.py", line 672, in emit
    return self._events.emit(event_name, **kwargs)
  File "/home/thapakazi/.pip/lib/python3.7/site-packages/botocore/hooks.py", line 356, in emit
    return self._emitter.emit(aliased_event_name, **kwargs)
  File "/home/thapakazi/.pip/lib/python3.7/site-packages/botocore/hooks.py", line 228, in emit
    return self._emit(event_name, kwargs)
  File "/home/thapakazi/.pip/lib/python3.7/site-packages/botocore/hooks.py", line 211, in _emit
    response = handler(**kwargs)
  File "/usr/lib/python3.7/site-packages/awscli/customizations/assumerole.py", line 43, in inject_assume_role_provider_cache
    'assume-role-with-web-identity'
  File "/home/thapakazi/.pip/lib/python3.7/site-packages/botocore/credentials.py", line 1731, in get_provider
    return self.providers[self._get_provider_offset(name)]
  File "/home/thapakazi/.pip/lib/python3.7/site-packages/botocore/credentials.py", line 1737, in _get_provider_offset
    raise UnknownCredentialError(name=name)
botocore.exceptions.UnknownCredentialError: Credential named assume-role-with-web-identity not found.
2019-08-16 12:35:49,203 - MainThread - awscli.clidriver - DEBUG - Exiting with rc 255

Credential named assume-role-with-web-identity not found.

Just commenting it here, if someone out there is going via similar blunder :see_no_evil:

[thearthur]

I self-made the same problem, the solution was:
rm ~/.local/lib/python3.7/site-packages/boto* -rf

[spanierm]

@thearthur Thanks, helped me right now as well :)

[no-response[bot]]

This issue has been automatically closed because there has been no response to our request for more information from the original author. With only the information that is currently in the issue, we don't have enough information to take action. Please reach out if you have or find the answers we need so that we can investigate further.

[mindrunner]

I self-made the same problem, the solution was:
rm ~/.local/lib/python3.7/site-packages/boto* -rf

Amazon should hire you to tell them how to do the homework. Thanks buddy. This was bugging me for weeks and I wonder how an enduser (in regards of using awscli) is supposed to figure that out by himself...