Aws-vault: Ubuntu: The collection "aws-vault" does not exist. Please add a key first

[sporto]

I added the env var AWS_VAULT_BACKEND as shown in https://github.com/99designs/aws-vault/blob/master/USAGE.md

The ran aws-vault add account-name. Ubuntu prompted for my password. Then got Added credentials to profile "account-name" in vault

Then trying to use aws-vault fails with The collection "aws-vault" does not exist. Please add a key first

aws-vault --debug ls shows this:

2018/01/18 16:46:34 [keyring] Considering backends: [secret-service]
2018/01/18 16:46:34 Loading config file /home/sebastian/.aws/config
2018/01/18 16:46:34 Parsing config file /home/sebastian/.aws/config
aws-vault: error: The collection "aws-vault" does not exist. Please add a key first

This is in Ubuntu 17.10

Any pointers? thanks

[lox]

See https://github.com/99designs/aws-vault/issues/214.

The default backend on ubuntu is KWalletManager, seems KWalletManager needs to be manually installed?

[myoung34]

$ printenv | grep AWS_VAULT
AWS_VAULT_BACKEND=secret-service

$ rm -rf ~/.aws

$ aws-vault add foo --debug
2018/01/21 22:52:57 [keyring] Considering backends: [secret-service]
2018/01/21 22:52:57 Loading config file /home/marc/.aws/config
2018/01/21 22:52:57 Config file /home/marc/.aws/config doesn't exist
Enter Access Key ID: a
Enter Secret Access Key: b
Added credentials to profile "foo" in vault
2018/01/21 22:53:01 Looking for sessions for foo
2018/01/21 22:53:01 Looking up all keys in keyring
2018/01/21 22:53:01 Adding profile foo to config at /home/marc/.aws/config
aws-vault: error: Error adding profile: &errors.errorString{s:"No iniFile to add to"}

$ mkdir  ~/.aws; touch ~/.aws/config

$ aws-vault add foo --debug
2018/01/21 22:53:15 [keyring] Considering backends: [secret-service]
2018/01/21 22:53:15 Loading config file /home/marc/.aws/config
2018/01/21 22:53:15 Parsing config file /home/marc/.aws/config
Enter Access Key ID: a
Enter Secret Access Key: b
Added credentials to profile "foo" in vault
2018/01/21 22:53:18 Looking for sessions for foo
2018/01/21 22:53:18 Looking up all keys in keyring
2018/01/21 22:53:18 Adding profile foo to config at /home/marc/.aws/config

$ cat ~/.aws/config 
[profile foo]

$ aws-vault list --debug
2018/01/21 22:55:48 [keyring] Considering backends: [secret-service]
2018/01/21 22:55:48 Loading config file /home/marc/.aws/config
2018/01/21 22:55:48 Parsing config file /home/marc/.aws/config
aws-vault: error: The collection "aws-vault" does not exist. Please add a key first

[sporto]

Yes, I had to install KWalletManager manually (with AWS_VAULT_BACKEND unset)

[brontolinux]

I have a similar problem in Debian Stretch. secret-service backend, aws-vault add runs, then when I try and run anything it spits out the usual message The collection "aws-vault" does not exist"

When I run aws-vault add it appears to try since a aws-vault keyring is created, but the moment aws-vault tries to add the keys something must break because either seahorse crashes on start, or it crashes if it is open. In both cases the error is a segmentation fault.

Another strangeness is that if I try to add my keys again and again it still won't work, but when I manage to have seahorse running I'll see two aws-vault keyrings -- empty, of course.

[piponazo]

I just want to inform that I had the same issue with 4.2.0 and with 4.1.0 I do not have the issue.

[lox]

Folks, I’m afraid I don’t have the time to install Ubuntu and Gnome/KDE. I’d welcome a PR, but I’m unlikely to look at this personally any time soon.

On 1 Feb 2018, at 8:00 pm, Luis Díaz Más [e-mail] wrote:

I just want to inform that I had the same issue with 4.2.0 and with 4.1.0 I do not have the issue.

—
You are receiving this because you commented.
Reply to this email directly, view it on GitHub, or mute the thread.

[brontolinux]

I am afraid I don't have the skills to provide a patch, all I can do is to provide feedback. And that's done :-)

[crielly]

My observed behaviour - under 4.1.0, the collection created in your keychain is called awsvault. Under 4.2.0, it's aws-vault and lookup fails because it's looking for awsvault.

Maybe I'm missing something...or maybe it really is that simple?

[lox]

@crielly that sounds like a regression, but I'm not sure it's the cause of this issue. I'm still not quite sure honestly what the different between kdewallet (https://github.com/99designs/keyring/blob/master/kwallet.go#L16) and secret-service . https://github.com/99designs/keyring/blob/master/libsecret.go) are. The both seem to use dbus (which I'm also only hand-wavingly familiar with).

My best guess at this stage is that our detection of whether those two backends exist is lousy. Could I trouble you folks to provide clear descriptions of what backend services you are hoping to use (e.g secret-service / libsecret or kwallet)? Any pointers for detecting whether those services are available on a system would also be appreciated.

[myoung34]

This happens to me 1 out of 3 times randomly.

$ aws-vault exec work -- awslogs get /aws/lambda/uptime_pinger --start='1h' --watch
aws-vault: error: Failed to get credentials for redact (source profile for work): 
The collection "aws-vault" does not exist. Please add a key first                                                                                        

$ aws-vault exec work -- awslogs get /aws/lambda/uptime_pinger --start='1h' --watch 
Enter token for arn:aws:iam::redact:mfa/marc: 491859    

Heres my exec 30 times. The jq failures are the error message above:

$ for i in {1..30}; do aws-vault exec work -- aws iam get-role --role-name ops | jq -r '.Role.RoleName'; done
ops
ops
ops
ops
ops
ops
ops
ops
ops
ops
ops
ops
ops
ops
ops
ops
parse error: Invalid numeric literal at line 1, column 10
ops
parse error: Invalid numeric literal at line 1, column 10
ops
ops
parse error: Invalid numeric literal at line 1, column 10
ops
ops
ops
ops
ops
parse error: Invalid numeric literal at line 1, column 10
ops
ops

[gunnaringe]

I think this should fix it: https://github.com/99designs/aws-vault/pull/226

For me it seems like @crielly is right.

The keyring library used to set collection name to 'awsvault'.
This was removed, and they added support for setting ServiceName and LibSecretCollectionName where LibSecretCollectionName is set to ServiceName if omitted.

[nrb]

I just tested this on Fedora 27 with gnome-keyring 3.20.1 and libsecret 0.18.5-5.fc27; it works as @gunnaringe says. Thanks for that patch!

[myoung34]

I built master today and have been using it.
Before the fix: 30% of the time it would fail (see above) due to aws-vault not found.
With the fix, its happened only once, but

$ aws-vault exec work -- terraform apply -auto-approve
aws-vault: error: Failed to get credentials for redact (source profile for work): 
The collection "awsvault" does not exist. Please add a key first

[pecigonzalo]

To add to this, it seems like without setting AWS_VAULT_BACKEND the backend rotates between secret-service and kwallet, that is why it shows the does not exist sometimes.

❯ aws-vault list --debug
2018/03/12 09:59:50 [keyring] Considering backends: [secret-service kwallet file]
2018/03/12 09:59:50 Loading config file /home/gonzalo.peci/.aws/config
2018/03/12 09:59:50 Parsing config file /home/gonzalo.peci/.aws/config
aws-vault: error: The collection "aws-vault" does not exist. Please add a key first
❯ aws-vault list --debug
2018/03/12 09:59:52 [keyring] Considering backends: [kwallet secret-service file]
2018/03/12 09:59:52 Loading config file /home/gonzalo.peci/.aws/config
2018/03/12 09:59:52 Parsing config file /home/gonzalo.peci/.aws/config
2018/03/12 09:59:52 Looking up all keys in keyring
[...]

@lox AFAIK, secret-service as a newish freedesktop standard that both KDE and GNOME will eventually share. Currently I believe its only used by GNOME and not fully implemented on KDE (https://community.kde.org/KDE_Utils/ksecretsservice) but it will eventually replace kwallet

[nitrocode]

I tested this on ubuntu 16 and it defaulted to kwallet. Once I switched it to use secret-service, it worked. Nice work! Besides creating an overriding script, is there a way to make aws-vault use a different backend by default using some home directory config file?

For now, I modified the script and saved it to /usr/local/bin/awsv

#!/bin/bash
exec aws-vault --backend=secret-service exec "${AWS_DEFAULT_PROFILE:-default}" -- /usr/local/bin/aws "$@"

Run

$ awsv s3 ls

[gi-wg2]

Setting export AWS_VAULT_BACKEND=secret-service in .bashrc works for me using aws-vault v4.2.1

I guess the output of aws-vault --version and AWS_VAULT_BACKEND=secret-service aws-vault --debug exec default -- env could be useful to debug this.

[lox]

Yup, I use the ENV in my shell to configure it.

[stale[bot]]

This issue has been automatically marked as stale because it has not had recent activity. It will be closed if no further activity occurs. Thank you for your contributions.

[Leigh-M]

Was there a solution to this? On Ubuntu 20.04 LTS it does not work out of the box, I am also seeing:

aws-vault --debug list  
2021/02/23 16:57:57 [keyring] Considering backends: [secret-service]
2021/02/23 16:57:57 Loading config file /home/username/.aws/config
2021/02/23 16:57:57 Parsing config file /home/username/.aws/config
aws-vault: error: The collection "aws-vault" does not exist. Please add a key first