rotate fails "resource: user null" #190
Comments
|
Any luck on this? I'm running into the exact same problem. I've used this successfully in the past, so I wonder if there was a change in how AWS handles the empty requestParameters? |
|
What version are you on @clintoncampbell? This isn't a bug with aws-vault, it's generally a case of your user not having the correct permissions. |
|
Both @clintoncampbell and @FernandoMiguel, could you explain how your credential setup looks? Are you assuming roles? Did you use the root credentials, or an iam user or an assumed role to try and rotate permissions? Did you verify that your user DOES have permission for |
|
I'm using 4.1.0. Absolutely, users are attached to a Humans group with an inline policy giving them the ability to manage passwords and access keys directly: {
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Action": [
"iam:*LoginProfile",
"iam:*AccessKey*",
"iam:*SSHPublicKey*"
],
"Resource": "arn:aws:iam::ACCOUNTID:user/${aws:username}"
},
{
"Effect": "Allow",
"Action": [
"iam:ListAccount*",
"iam:GetAccountSummary",
"iam:GetAccountPasswordPolicy",
"iam:ListUsers"
],
"Resource": "*"
}
]
}Replicating the process through the AWS CLI without aws-vault works as long as I specify a user, e.g., All that said, I think it may have been an incorrect account id in the policy on my end. |
|
Yep, I can confirm that rotate is working correctly since I fixed the account ID in this policy. |
|
$ aws-vault --version no idea what this is our IAM account, so i am not assuming a role just yet. every other profile is a role. this is our MFA policy, which is as referred in the OP an exact copy of aws provided policy iam:UpdateAccessKey and iam:CreateAccessKey are in there. I wonder if the fact that i never got to enter the MFA is the reason for the failure? |
|
from cloud trail this |
|
was looking at https://github.com/99designs/aws-vault/pull/180/files |
|
no luck with that |
|
Have you tried replicating the process from the CLI to ensure the individual steps are working? |
|
@FernandoMiguel This could also have to do with the manner in which you've set up your profiles in config. I'm curious whether your |
|
this is my ~/.aws/config @clintoncampbell so trying to change the key for the 1st profile which is the one with the keys |
This is an AWS bug as far as I could tell. |
|
Could I trouble you to try this with the latest master @FernandoMiguel? |
|
I'll try to give it a go tomorrow
…--
Fernando Miguel
|
|
@lox what's the easiest way to grant access to the docker container to the keychain ? |
|
As in, how do you access your macOS keychain from a linux docker container? If so, the answer would be about 3 years of development :) |
|
Ahaha But first, it needs to work, and I've opened another ticket for some issues the Dockerfile is having |
|
Ping @lox |
|
Let me know if you get a chance to test |
|
I did try via compiling from source in Docker but was broken. Currently away from my laptop with no chance to test it |
|
This was with version 4.1 just a couple of days before 4.2 come out |
|
Is your laptop macOS? I can walk you through getting enough golang on there to run it if that helps. |
|
I can put go there. Usually avoid pestering extra build tools into the host. I'll give it a go |
testing 4.2 with --no-session to see if i could use @0xdabbad00 trick. no luck let me try from master. i'll see if i try it with an user that doesnt have any restrictive MFA policies |
test account with no policies and no mfa, works |
|
just added MFA to that user, and to my surprise, it never asked for it :O |
|
i just applied this policy to user test and still fails with |
|
Shouldn't you be using |
|
I get the same error when I try and rotate my |
|
@lox test user add Administrator profile attached |
|
@lox what do you mean with iam profile? |
When you say "added MFA", what did you do? |
|
Added a MFA key to the test user profile and to .aws/config
…--
Fernando Miguel
On 23 Jan 2018 21:44, "Lachlan Donald" ***@***.***> wrote:
just added MFA to that user, and to my surprise, it never asked for it :O
When you say "added MFA", what did you do?
—
You are receiving this because you were mentioned.
Reply to this email directly, view it on GitHub
<#190 (comment)>,
or mute the thread
<https://github.com/notifications/unsubscribe-auth/AAKRrgPfXS5MG0zIA8M8rC9GnanwO9yrks5tNlK4gaJpZM4QkZMj>
.
|
|
🤔 The fact then that it didn't ask you for an MFA is perplexing. Perhaps that is the issue. Let me investigate. |
|
Confirm the same issue |
|
Humm never tried login eheh I still haven't had the chance to try master code. |
|
@lox i added this IAM inline policy but didn't change anything |
|
I'm seeing the same thing here, tried on |
|
This issue has been automatically marked as stale because it has not had recent activity. It will be closed if no further activity occurs. Thank you for your contributions. |
|
This was still happening last time I tried it with a restricted policy |
|
Did you eventually figure it out @FernandoMiguel ? I'm having the same issue of |
I don't recall @timotheeg . |
I've got the default MFA policy in place
http://docs.aws.amazon.com/IAM/latest/UserGuide/tutorial_users-self-manage-mfa-and-creds.html
where's the cloudtrail via webconsole
and here a cloudtrail fail from aws-vault
The text was updated successfully, but these errors were encountered: