aws-sso-cli icon indicating copy to clipboard operation
aws-sso-cli copied to clipboard

Unable to use profile name

Open adkafka opened this issue 3 years ago • 0 comments

Output of aws-sso version:

AWS SSO CLI Version 1.7.4 -- Copyright 2021-2022 Aaron Turner
3624b90beb5511257f1516edf305aa4517d553e5 (v1.7.4-20-g3624b90) built at 2022-03-25T13:56:00-0700

Describe the bug: There appears to be a bug in the logic around parsing the AWS account ID and Role from a profile name

To Reproduce:

  1. Load up a config file that includes role names:
SSOConfig:
 DefaultSSO:
   SSORegion: us-west-2
   StartUrl: URL
   DefaultRegion: us-west-2
   Accounts:
    111111111111:
      Name: Foo
      Roles:
        actual-role:
          Profile: test-profile
  1. Run aws-sso eval -p test-profile --level debug. See error:
DEBU[0000] Getting role credentials for arn:aws:iam::111111111111:role/actual-role 
DEBU[0000] Fetching STS token from AWS SSO              
DEBU[0000] Getting 111111111111:actual-role via          
FATA[0000] Unable to get role credentials for arn:aws:iam::111111111111:role/actual-role  error="Invalid Via : Unable to parse ARN: "

Expected behavior: The above command should succeed without error.

Desktop (please complete the following information):

  • OS: macOS Catalina

Theory: I believe there is a bug in this line: https://github.com/synfinatic/aws-sso-cli/blob/de3a6333fab39deab92cc2b245a1e8437ec4f0c9/sso/awssso.go#L281. This reads if err != nil && configRole.Via == "", but it should read if err == nil && configRole.Via == "". We should enter that block if there is no error. It appears to me that the previous line succeeds without error, but we don't enter that block. Instead, we skip, and try to use the Via below, but that fails because the Via is empty (default).

adkafka avatar Aug 17 '22 21:08 adkafka