Aws-sdk-net: Unable to get Default Credentials using CredentialProfileStoreChain

[mrawdon]

Expected Behavior

When calling credentialProfileStoreChain.TryGetAWSCredentials("default", out defaultCredentials) with a valid profile named default I would expect it to return true and set the credentials properly.

Current Behavior

The credentials are not loaded for the default profile, but it will work for other profile names

Possible Solution

For a workaround I am able to use the deprecated call AWSCredentials creds = new StoredProfileAWSCredentials("default");

Steps to Reproduce (for bugs)

            var credentialProfileStoreChain = new CredentialProfileStoreChain();
            AWSCredentials otherCredentials;
            if (credentialProfileStoreChain.TryGetAWSCredentials("other_user", out otherCredentials))
                Console.WriteLine("Found other_user credentials using CredentialProfileStoreChain");
            else
                Console.WriteLine("Could not find other_user credentials using chain");

            AWSCredentials defaultCredentials;
            if (credentialProfileStoreChain.TryGetAWSCredentials("default", out defaultCredentials))
                Console.WriteLine("Found default credentials using chain");
            else
                Console.WriteLine("Could not find default credentials using CredentialProfileStoreChain");

            try
            {
                AWSCredentials creds = new StoredProfileAWSCredentials("default");
                Console.WriteLine("Got default credentials using deprecated StoredProfileAWSCredentials");
            }
            catch (Exception e)
            {
                Console.WriteLine("Could not get default credentials using deprecated StoredProfileAWSCredentials" + e.Message);
                Console.WriteLine(e.StackTrace);
            }

Credentials file stored under C:Users.awscredentials

[default]

aws_access_key_id = XXXXXXXXXXXXXXXXXXX

aws_secret_access_key = XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX

[other_user]

aws_access_key_id = XXXXXXXXXXXXXXXXXXX

aws_secret_access_key = XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX

Results of running code above

Found other_user credentials using CredentialProfileStoreChain
Could not find default credentials using CredentialProfileStoreChain
Got default credentials using deprecated StoredProfileAWSCredentials

Context

I am trying to use my default profile to get credentials without using deprecated code.

Your Environment

• AWSSDK.Core version used: 3.3.24.6
• Operating System and version: Windows 10
• Visual Studio version: Comunity 2015
• Targeted .NET platform: 4.5

[vellozzi]

Do you also have a C:\Users\<user>\.aws\config file? If so can you include a redacted version of that here too?

[mrawdon]

Yeah the contents are

[preview]
cloudfront = true
[default]
region = us-east-1
[wedding]
region = us-east-1

[vellozzi]

Try changing [default] to [profile default] in the config file.

[mrawdon]

I changed my config file to the following, and still got the same results

[preview]
cloudfront = true
[profile default]
region = us-east-1
[wedding]
region = us-east-1

I also tried with the following

[profile default]
region = us-east-1

[vellozzi]

Does it work if you use the SharedCredentialsFile class to access them?
The CredentialProfileStoreChain checks the .NET Encrypted Credential store first. So it's possible there's some interaction from that. If SharedCredentialsFile is able to access the default profile, and there's also a default profile in the encrypted store (check the AWS explorer in Visual Studio), try removing the default profile from the encrypted store.

[mrawdon]

The code below correctly iterates over my profiles and gets the credentials

            SharedCredentialsFile sf = new SharedCredentialsFile();
            foreach (var profile in sf.ListProfiles())
            {
                profile.GetAWSCredentials(sf);
                Console.WriteLine($"Got {profile.Name} credentials using SharedCredentialsFile");
            }

There doesn't appear to be a default credential in the .NET store(I just created the test one)

[vellozzi]

Temporarily rename or move C:\Users\<user>\AppData\Local\AWSToolkit\RegisteredAccounts.json and then try the CredentialProfileStoreChain again. Let me know how that goes.

[mrawdon]

Removing that file worked. The contents are below, looks like I have a default entry with no keys

{
    "XXXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX" : {
        "Region" : "us-east-1",
        "DisplayName" : "default"
    },
    "XXXXXXXXXXXXX-XXXX-XXXX-XXXXXXXXXXXX" : {
        "AWSAccessKey" : "XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX",
        "DisplayName"  : "test",
        "AWSSecretKey" : "XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX",
        "Restrictions" : ""
    }
}

[vellozzi]

OK. Remove that from the RegisteredAccounts.json file manually and everything should work fine then. Feel free to reopen if you have more questions.

[mrawdon]

@vellozzi that works for me, but we're trying to put this into an application that we will distribute. I'm concerned that one of our end users could end up with the same experience. It seems weird that the .NET has a different behavior when loading credentials then Java or any of the AWS cli tools I have used.

[vellozzi]

The reason for the difference is that the encrypted .NET credential store in the AWS Toolkit for Visual Studio predates the shared credentials files used by the AWS CLI and other SDKs. I'm working on a way to skip the profile in the .NET credentials file if it's incomplete, and check the shared credentials file. Will update when a fix is ready.

[supergibbs]

I ran into this issue too and changing to [profile default] worked for me but not ideal.

I believe a special case for "default" needs to be added here:
https://github.com/aws/aws-sdk-net/blob/master/sdk/src/Core/Amazon.Runtime/Internal/Util/_bcl+netstandard/ProfileIniFile.cs#L60

~Somewhat related, my app run with a role in production. So ideally I want not use any credentials parameter and have it use my default profile from my config file which assumes the dev role to run locally. Then code is the same for local, dev and prod. This doesn't work currently.~

UPDATE: Actually using [profile default] fixes my other issue too. Should be an easy fix, I'll give it a shot.

[github-actions[bot]]

We have noticed this issue has not recieved attention in a year. We will close this issue for now. If you think this is in error, please feel free to comment and reopen the issue.

[supergibbs]

My PR #1366 closed this issue for me

[108adams]

I went into the same problem just today, creating a no-brainer example from tutorial on AWS documentation pages: new AmazonS3Client() could not be initialized due to lack of region. Using current (as for Oct 2020) AWS CLI tools and .NET SDK. Removing .json file solved the issue, region is properly read from the config files now. I believe this issue should be documented in the main documentation, it took me all the evening to get here...