Aws-sdk-go: INI parser doesn't accept ARNs as section headers/profile names

Created on 1 Nov 2018  路  2Comments  路  Source: aws/aws-sdk-go

Version of AWS SDK for Go?

introduced in 704cb4634ea23d666b1046363639d44234fb4ed2 (v1.15.59 and after)

Version of Go (go version)?

N/A

What issue did you see?

We use AWS SAML account federation to assume roles in AWS, and as part of our tooling we insert role credentials into the standard credentials file using the ARN of the role as the profile name.
In the above commit, the tokenizer for string stops on :, which causes ARNs to be considered invalid as section header names.
The java AWS SDK and python (through configparser) handles these correctly.
Quoting the ARN as per the quoted-string in the grammar allows go to parse the file, but configparser ends up including the quotes in its section instance variables, breaking other tooling reliant on such profile names.

Steps to reproduce

Run a go program linked to this SDK with no AWS environment variables set, and the following into your ~/.aws/credentials:

[default]
aws_access_key_id=<YOUR_ACCESS_KEY>
aws_secret_access_key=<YOUR_ACCESS_SECRET_KEY>

[arn:aws:sts::1234:assumed-role/My-Role/session-name]
; this section can be filled if you like.

We spotted this issue when running terraform with the AWS provider v1.42.0, which is linked against the newest AWS sdk.

bug

Most helpful comment

@rafaelfc-olx - We just merged in #2247. Please let us know if you have any additional issues.

All 2 comments

Hello @rafaelfc-olx, thank you for reaching out to us and reporting this. The easy mitigation is to wrap your string in quotes and I'll take a look at fixing this.

@rafaelfc-olx - We just merged in #2247. Please let us know if you have any additional issues.

Was this page helpful?
0 / 5 - 0 ratings