aws-vault: error: Failed to get credentials for mycompany-identity (source profile for mycompany-dev): exit status 1

[kurtmc]

On aws-vault version 4.5.1 (running on linux with freedesktop.org Secret Service backend), I sometimes get an error when I run a command like this:

aws-vault exec mycompany-dev -- aws s3 ls s3://mybucket

I see an error like this:

Error: mycompany-identity is not in the password store.
aws-vault: error: Failed to get credentials for mycompany-identity (source profile for mycompany-dev): exit status 1

If I run the same command multiple times it will eventually succeed.

My ~/.aws/config looks like this:

[profile mycompany-identity]                                                                                                                                                                                                                                                               
output = json                                                                                                                                                                                                                                                                              
region = ap-southeast-2                                                                                                                                                                                                                                                                    

[profile mycompany-dev]                                                                                                                                                                                                                                                                    
source_profile = mycompany-identity                                                                                                                                                                                                                                                        
mfa_serial = arn:aws:iam::123456789012:mfa/kurt                                                                                                                                                                                                                                            
output = json                                                                                                                                                                                                                                                                              
region = ap-southeast-2                                                                                                                                                                                                                                                                    
role_arn = arn:aws:iam::111111111111:role/AdminRole

Is anyone aware of this issue?

[herman-toothrot]

@kurtmc I had the same problem on 4.5.1 that it's eventually failing (also running on linux with freedesktoop.org secret service backend).
After setting the backend via the environment variable (export AWS_VAULT_BACKEND=secret-service) as written in the documentation the error disappeared for me.

[milosgajdos]

The same thing is happening on macOS @kurtmc

I'll try @herman-toothrot suggestion and see if it helps in the future -- I'm guessing the aws-vault probably does not detect the OS you're on automatically so it needs to be told AWS_VAULT_BACKEND explicitly? Just a guess -- I havent had a chance to look into the code.

[kurtmc]

@milosgajdos83 This solved it for me. My guess would be that aws-vault tries to detect the vault backend and since I have pass and secret-service maybe it guesses wrong sometimes?

[milosgajdos]

@milosgajdos83 This solved it for me. My guess would be that aws-vault tries to detect the vault backend and since I have pass and secret-service maybe it guesses wrong sometimes?

There does seem to be some "guessing" happening :-) I'm hoping to have some free time tomorrow to look into the code a bit and see.

[christophgysin]

This is caused by https://github.com/99designs/keyring/issues/35, and a suggested fix is provided in https://github.com/99designs/keyring/pull/36. Go vote on these!

[lox]

Good points, let's see if we can merge some of those and fix this.

[lox]

Sorry I've been slow on your PR's @christophgysin 😓 Open-source is hard!

[lox]

Ok, I've merged that keyring PR. I believe we just need a bump of the keyring library here.

[kjenneycloudhealth]

This functionality is broken in 4.6.2. I ended up downgrading to 4.4.1. Now it works and nothing was lost (keychain is still intact with sessions).

[kjenneycloudhealth]

PR to bump the keyring library: https://github.com/99designs/aws-vault/pull/402

[mtibben]

This should be resolved in https://github.com/99designs/aws-vault/releases/tag/v4.6.3, reopen if not