Unable to use profile name
Output of aws-sso version:
AWS SSO CLI Version 1.7.4 -- Copyright 2021-2022 Aaron Turner
3624b90beb5511257f1516edf305aa4517d553e5 (v1.7.4-20-g3624b90) built at 2022-03-25T13:56:00-0700
Describe the bug: There appears to be a bug in the logic around parsing the AWS account ID and Role from a profile name
To Reproduce:
- Load up a config file that includes role names:
SSOConfig:
DefaultSSO:
SSORegion: us-west-2
StartUrl: URL
DefaultRegion: us-west-2
Accounts:
111111111111:
Name: Foo
Roles:
actual-role:
Profile: test-profile
- Run
aws-sso eval -p test-profile --level debug. See error:
DEBU[0000] Getting role credentials for arn:aws:iam::111111111111:role/actual-role
DEBU[0000] Fetching STS token from AWS SSO
DEBU[0000] Getting 111111111111:actual-role via
FATA[0000] Unable to get role credentials for arn:aws:iam::111111111111:role/actual-role error="Invalid Via : Unable to parse ARN: "
Expected behavior: The above command should succeed without error.
Desktop (please complete the following information):
- OS: macOS Catalina
Theory:
I believe there is a bug in this line: https://github.com/synfinatic/aws-sso-cli/blob/de3a6333fab39deab92cc2b245a1e8437ec4f0c9/sso/awssso.go#L281. This reads if err != nil && configRole.Via == "", but it should read if err == nil && configRole.Via == "". We should enter that block if there is no error. It appears to me that the previous line succeeds without error, but we don't enter that block. Instead, we skip, and try to use the Via below, but that fails because the Via is empty (default).