Aws-iam-authenticator: Credentials not found when used with AWS SSO

[psaffrey-origami]

I want to use aws-iam-authenticator to connect to a k8s cluster based on AWS IAM integrated with SSO. I connect to AWS based on these instructions:

https://docs.aws.amazon.com/cli/latest/userguide/cli-configure-sso.html

Having run the aws configure sso a browser tab opens and a number of redirects happen. Then I click a button to confirm AWS CLI access, I enter a few more preferences including a profile name and the command finishes. After this, I can successfully run:

$ aws sts get-caller-identity --profile my-profile-name

to show I am authenticated. However, if I set this profile as my $AWS_PROFILE and try to run aws-iam-authenticator:

$ aws-iam-authenticator token -i my-cluster-id
could not get token: NoCredentialProviders: no valid providers in chain. Deprecated.
For verbose messaging see aws.Config.CredentialsChainVerboseErrors

Digging into this in more detail, it looks like the SSO auth process has not produced the usual AWS credentials file in $HOME/.aws/credentials. Instead, there is a json file in $HOME/.aws/cli/cache that has the usual access ID, secret ID and session token. If I render these as environment variables or into a credentials file then my aws-iam-authenticator call works fine and I can wire it into my .kube/config file to run commands against my cluster.

I also looked at the underlying Go SDK methods and I can't, indeed, see any credentials providers for this type of cache file. Does this mean the problem is upstream in the Go SDK? Shall I raise an issue there?

Superficially, this issue looks similar to some others, but I think these are different:

• https://github.com/kubernetes-sigs/aws-iam-authenticator/issues/141 - but I think this is about third-party credential providers, not those that are generated by native AWS SSO integration
• https://github.com/kubernetes-sigs/aws-iam-authenticator/pull/193 - but I think this is about caching the AWS credential obtained from SSO in exactly the same way the AWS2.0 CLI is currently doing, rather than reading those back for adhoc kubectl usage.

Happy to be corrected on any of this - where am I going wrong?

[romenyrr]

Update on 4/4/20
The new AWS-CLI command supports both aws-sso and aws-eks get-token so there's no need to connect with aws-iam-authenticator anymore. Updating the ~/.kube/config context to connect with command: aws to get the EKS token worked like a charm. Hope this helps psaffrey-origami

---

I'm running across the same issue when using aws-cli (v.2) & aws-iam-auth (v5). It seems that even though the credentials are properly loaded, export AWS_PROFILE, by running aws sts get-caller-identity, I think there's an issue with the type output where it references sso. Like you, I was able to extract the creds from .aws/cli/cache/and load them as env variables and that worked as expected when running kubectl.

$ aws configure list                                                                                                                                                                   │···········
      Name                    Value             Type    Location                                                                                                                       │···········
      ----                    -----             ----    --------                                                                                                                       │···········
   profile                  EKSUser           manual    --profile                                                                                                                      │···········
access_key     ****************1234              sso                                                                                                                                   │···········
secret_key     ****************abcd              sso                                                                                                                                   │···········
    region                us-east-1      config-file    ~/.aws/config   

I've also tried adjusting my Kube config map to reference the named profile, but no luck there:

apiVersion: v1
clusters:
- cluster:
    server: <endpoint-url>
    certificate-authority-data: <base64-encoded-ca-cert>
  name: kubernetes
contexts:
- context:
    cluster: kubernetes
    user: aws
  name: aws
current-context: aws
kind: Config
preferences: {}
users:
- name: aws
  user:
    exec:
      apiVersion: client.authentication.k8s.io/v1alpha1
      command: aws-iam-authenticator
      args:
        - "token"
        - "-i"
        - "eks-cluster-name"
      env:
        - name: AWS_PROFILE
          value: "EKSUser"

[fejta-bot]

Issues go stale after 90d of inactivity.
Mark the issue as fresh with /remove-lifecycle stale.
Stale issues rot after an additional 30d of inactivity and eventually close.

If this issue is safe to close now please do so with /close.

Send feedback to sig-testing, kubernetes/test-infra and/or fejta.
/lifecycle stale

[fejta-bot]

Stale issues rot after 30d of inactivity.
Mark the issue as fresh with /remove-lifecycle rotten.
Rotten issues close after an additional 30d of inactivity.

If this issue is safe to close now please do so with /close.

Send feedback to sig-testing, kubernetes/test-infra and/or fejta.
/lifecycle rotten

[fejta-bot]

Rotten issues close after 30d of inactivity.
Reopen the issue with /reopen.
Mark the issue as fresh with /remove-lifecycle rotten.

Send feedback to sig-testing, kubernetes/test-infra and/or fejta.
/close

[k8s-ci-robot]

@fejta-bot: Closing this issue.

In response to this:

Rotten issues close after 30d of inactivity.
Reopen the issue with /reopen.
Mark the issue as fresh with /remove-lifecycle rotten.

Send feedback to sig-testing, kubernetes/test-infra and/or fejta.
/close

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

[gaffneyd4]

Great news! AWS SSO Credential Provider support was added to the aws go sdk in version v1.37.0.

I have opened a PR in this project to update the version of the sdk so that we are able to use SSO credentials with the aws-iam-authenticator.

In my local testing after rebuilding with the updated sdk, SSO credentials are recognized and authentication works as expected.

[lkskrt]

I just had the same problem, but @romenyrr's updated comment pointed me in the right direction.

So to make it a bit more clear, as others seem to have the same issue:

What you can do today is completely skip aws-iam-authenticator locally and just use AWS CLI v2:

users:
- name: my-user
  user:
    exec:
      apiVersion: client.authentication.k8s.io/v1alpha1
      command: aws
      args:
      - eks
      - get-token
      - --cluster-name
      - my-cluster-name
      env:
      - name: AWS_PROFILE
        value: my-sso-profile-name

[elatt]

The code as been merged for a couple of months now. When will a new release of the binary be available?