Aws-vault: credentials in backend "pass" not shown

[lusitania]

My credentials aren't found

$ aws-vault --backend pass --pass-cmd=gopass --pass-prefix=foo/aws-vault --debug list
2019/10/02 16:04:48 [keyring] Considering backends: [pass]
2019/10/02 16:04:48 Loading config file /home/me/.aws/config
2019/10/02 16:04:48 Parsing config file /home/me/.aws/config
2019/10/02 16:04:48 Looking up all keys in keyring
Profile                  Credentials              Sessions
=======                  ===========              ========
default                  -                        -
aws-vault: error: No credentials found

$ aws-vault --backend pass --pass-cmd=gopass --pass-prefix=foo/aws-vault exec --no-session default
aws-vault: error: exec: Error getting temporary credentials: profile default: credentials missing

I've created it like this

$ gopass mounts add -i <mykey> foo /home/lusitania/gopass/foo
$ aws-vault --backend pass --pass-cmd=gopass --pass-prefix=foo/aws-vault add --add-config default
Added credentials to profile "default" in vault

$ gopass foo/aws-vault/
foo/aws-vault/
└── default

Doing the same with --backend file I can see it, though

$ aws-vault --backend file add --add-config default2

$ aws-vault --backend file list
Profile                  Credentials              Sessions
=======                  ===========              ========
default2                 default2                 -

I'm out of ideas how I can debug this any further. Please help.

$ aws-vault --version
v4.6.4

$ gopass --version
gopass 1.8.6 (d5b0d3b906cdd9f16ad3f21e366845af7f2c22f3) go1.12.7 linux amd64

[psanford]

This issue sounds like it might be fixed with https://github.com/99designs/keyring/pull/53. I can reproduce it with aws-vault without that patch and with that patch applied I don't see the error.

[lusitania]

Doesn't work with https://github.com/99designs/aws-vault/releases/tag/v4.7.0 (which incorporates 99designs/keyring#53), either. Don't know if this is relevant: The prefix foo is a mount-point.

[lusitania]

I've updated versions (v5.3.2) and tried again. No change.

[timnee]

Adding a prefix --pass-prefix=aws-vault ( or export AWS_VAULT_PASS_PREFIX=aws-vault ) worked for me.

[mbainter]

FYI - this doesn't work with 6.0.0-beta5 either. I believe this is something very specific to the mounts that gopass supports. When a mount is used (such as foo in the example in this ticket) it actually places that in a separate pass-dir (like ~/.password-store-foo).

If I set the PASS_DIR env variable to that path instead, it can see the credentials with aws-vault list but it can't actually use them (presumably because the key path doesn't match up properly).

[lusitania]

@timnee Adding a prefix --pass-prefix=aws-vault ( or export AWS_VAULT_PASS_PREFIX=aws-vault ) worked for me.

Your attempt is lacking the subfolder.

[dbeattie71]

@lusitania Were you able to get this working? I'm running into the same thing. It's almost as if --store needs passed along with pass-cmd because its not working with mount paths.

[lusitania]

@dbeattie71 unfortunately no. I've given up TBO.

[stale[bot]]

This issue has been automatically marked as stale because it has not had recent activity. It will be closed if no further activity occurs. Thank you for your contributions.