Aws-vault: Integration with AWS SSO

[christophetd]

I have the following SSO profile in ~/.aws/config:

[profile dev]
sso_start_url = https://xxx.awsapps.com/start
sso_region = eu-central-1
sso_account_id = yyyy
sso_role_name = MyRole

After logging in using aws --profile dev sso login, I am able to use this profile from the AWS CLI:

$ aws --version
aws-cli/2.0.38 Python/3.7.3 Linux/5.4.0-42-generic exe/x86_64.ubuntu.18

$ aws --profile dev sts get-caller-identity
{
    "UserId": "xxxx:[email protected]",
    "Account": "yyyy",
    "Arn": "arn:aws:sts::yyyy:assumed-role/AWSReservedSSO_MyRole_zzzz/[email protected]"
}

But when using aws-vault, it seems that it fails to use / import those credentials, and trying to manually add the profile to aws-vault prompts for explicit IAM access keys:

$ aws-vault --debug exec dev -- aws sts get-caller-identity
2020/08/18 17:10:37 aws-vault v6.0.0-beta9
2020/08/18 17:10:37 Loading config file /home/christophetd/.aws/config
2020/08/18 17:10:37 Parsing config file /home/christophetd/.aws/config
2020/08/18 17:10:37 [keyring] Considering backends: [secret-service]
aws-vault: error: exec: Failed to get credentials for dev: The specified item could not be found in the keyring

$ aws-vault --debug add dev
2020/08/18 17:10:58 aws-vault v6.0.0-beta9
2020/08/18 17:10:58 [keyring] Considering backends: [secret-service]
2020/08/18 17:10:58 Loading config file /home/christophetd/.aws/config
2020/08/18 17:10:58 Parsing config file /home/christophetd/.aws/config
Enter Access Key ID:

The usage document about SSO doesn't mention anything else than what the AWS config file should look like.

Am I missing something on how aws-vault is supposed to work with AWS SSO?

Thanks!

[christophetd]

This seems to be a regression of v6.0.0-beta9. Running the exact same command with aws-vault v6.0.0-beta5 works perfectly as expected

$ ./aws-vault-v6.0.0-beta9 --debug login dev

2020/08/18 18:10:12 aws-vault v6.0.0-beta9
2020/08/18 18:10:12 [keyring] Considering backends: [secret-service]
2020/08/18 18:10:12 Loading config file /home/christophetd/.aws/config
2020/08/18 18:10:12 Parsing config file /home/christophetd/.aws/config
aws-vault: error: login: Failed to get credentials for dev: The specified item could not be found in the keyring

$ ./aws-vault-v6.0.0-beta5 --debug login dev
2020/08/18 18:11:10 aws-vault v6.0.0-beta5
2020/08/18 18:11:10 [keyring] Considering backends: [secret-service kwallet pass file]
2020/08/18 18:11:10 Loading config file /home/christophetd/.aws/config
2020/08/18 18:11:10 Parsing config file /home/christophetd/.aws/config
2020/08/18 18:11:10 Re-using cached credentials ***************** from sso.GetRoleCredentialsInput, expires in 11h56m3.10456308s

[ajkerrigan]

Hey hey @christophetd - I was getting the same thing. Seems to be resolved on my end with 5f20470ca3c263800bfd0bd1e9b28a121a7eb666. Hopefully with that (and any subsequent beta releases) it'll be sorted out for you also.

[christophetd]

Good to know!

@mtibben Can we have a new release please? Thanks!

[adityati]

@christophetd aws-vault-v6.0.0-beta10 is out now that includes the fix!