aws-vault
aws-vault copied to clipboard
Can't set credentials for a profile with a `source_profile` directive to itself
- [x] I am using the latest release of AWS Vault (6.3.1)
- [x] I have provided my
.aws/config
(redacted if necessary) - [x] I have provided the debug output using
aws-vault --debug
(redacted if necessary)
[profile base]
output=json
region=us-west-2
source_profile=base
[profile role]
include_profile=base
role_arn=arn:aws:iam::############:role/################
λ aws-vault add base --debug
2022/01/07 14:08:23 aws-vault v6.3.1
2022/01/07 14:08:23 [keyring] Considering backends: [wincred]
2022/01/07 14:08:23 Loading config file C:\Users\########\.aws\config
2022/01/07 14:08:23 Parsing config file C:\Users\########\.aws\config
aws-vault: error: add: Your profile has a source_profile of base, adding credentials to base won't have any effect
I followed some suggestions in another issue/PR to structure the profiles this way, so that include_profile
(the AWS directive) pulls in the source_profile
(the AWS-Vault directive) into each of the role profiles in addition to the default region/output directives etc. I thought this was a better way of laying it out as I don't then need to add source_profile
to every role profile I create.
I think aws-vault might just need a bit of logic to check if the source_profile
directive is referring to itself when it does the check I ran into, if it is self referential then it's fine to set the credentials.
Workaround is just to comment out the line temporarily while setting the credentials.
Edit: https://github.com/99designs/aws-vault/blob/dd95b3a06939826d7dbea236f2000af3f9d8aeac/cli/add.go#L56 is the check in question.
This is still an issue in the current (v6.6.0) version of aws-vault
.
Our current workaround process (using the base
profile name above as an example):
- Add the
[profile base]
block as above, leaving thesource_profile=base
line commented out - Add the account via
aws-vault add base
- Uncomment the
source_profile=base
line
At this point, aws-vault exec base
commands work successfully. It would be nice to not have to perform these additional manual steps, however.
This issue has been automatically marked as stale because it has not had recent activity. It will be closed if no further activity occurs.