Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Failed to refresh process-based credentials #29

Closed
fjaccarino opened this issue Mar 29, 2023 · 14 comments
Closed

Failed to refresh process-based credentials #29

fjaccarino opened this issue Mar 29, 2023 · 14 comments
Labels
bug Something isn't working

Comments

@fjaccarino
Copy link

fjaccarino commented Mar 29, 2023 •
edited
Loading

Using the "profile from credentials file" option and setting the credentials and config files results in an error:
"Connection test failed: java.lang.IllegalStateException: Failed to refresh process-based credentials"

The same configuration works when using the Big Data Tools plugin in JetBrains.

What steps can I take to troubleshoot the connection issue?

DataGrip 2023.1
Build #DB-231.8109.163, built on March 27, 2023
Runtime version: 17.0.6+10-b829.5 aarch64
VM: OpenJDK 64-Bit Server VM by JetBrains s.r.o.

DynamoDB plugin:
2023.1.0-23
@AntonShuvaev
Copy link
Owner

There was a similar issue #25. Launching the IDE from the CLI should help. If not, please share the relevant stacktrace from idea.log.

@fjaccarino
Copy link
Author

fjaccarino commented Mar 29, 2023 •
edited
Loading

Works when launching from the CLI but do I have to change my workflow just for the plugin? All else works fine, even Big Data Tools can connect to AWS using a similar connection configuration. Would love for this to be seamless so I can roll out paid licenses to my team. Thoughts?

@AntonShuvaev
Copy link
Owner

Can you share the relevant stacktrace from idea.log (Help > Show Log in Finder ) and what credential_process is used for auth? I'll try to fix this.

@fjaccarino
Copy link
Author

fjaccarino commented Mar 29, 2023 •
edited
Loading

I see the log but lots of noise in here. What kind of text am I looking for to share?

@fjaccarino
Copy link
Author

fjaccarino commented Mar 29, 2023 •
edited
Loading 

java.lang.IllegalStateException: Failed to refresh process-based credentials.
	at software.amazon.awssdk.auth.credentials.ProcessCredentialsProvider.refreshCredentials(ProcessCredentialsProvider.java:139)
	at software.amazon.awssdk.utils.cache.CachedSupplier.lambda$jitteredPrefetchValueSupplier$3(CachedSupplier.java:283)
	at software.amazon.awssdk.utils.cache.CachedSupplier$PrefetchStrategy.fetch(CachedSupplier.java:419)
	at software.amazon.awssdk.utils.cache.CachedSupplier.refreshCache(CachedSupplier.java:198)
	at software.amazon.awssdk.utils.cache.CachedSupplier.get(CachedSupplier.java:127)
	at software.amazon.awssdk.auth.credentials.ProcessCredentialsProvider.resolveCredentials(ProcessCredentialsProvider.java:121)
	at software.amazon.awssdk.core.internal.util.MetricUtils.measureDuration(MetricUtils.java:50)
	at software.amazon.awssdk.awscore.internal.authcontext.AwsCredentialsAuthorizationStrategy.resolveCredentials(AwsCredentialsAuthorizationStrategy.java:100)
	at software.amazon.awssdk.awscore.internal.authcontext.AwsCredentialsAuthorizationStrategy.addCredentialsToExecutionAttributes(AwsCredentialsAuthorizationStrategy.java:77)
	at software.amazon.awssdk.awscore.internal.AwsExecutionContextBuilder.invokeInterceptorsAndCreateExecutionContext(AwsExecutionContextBuilder.java:120)
	at software.amazon.awssdk.awscore.client.handler.AwsSyncClientHandler.invokeInterceptorsAndCreateExecutionContext(AwsSyncClientHandler.java:69)
	at software.amazon.awssdk.core.internal.handler.BaseSyncClientHandler.lambda$execute$1(BaseSyncClientHandler.java:78)
	at software.amazon.awssdk.core.internal.handler.BaseSyncClientHandler.measureApiCallSuccess(BaseSyncClientHandler.java:179)
	at software.amazon.awssdk.core.internal.handler.BaseSyncClientHandler.execute(BaseSyncClientHandler.java:76)
	at software.amazon.awssdk.core.client.handler.SdkSyncClientHandler.execute(SdkSyncClientHandler.java:45)
	at software.amazon.awssdk.awscore.client.handler.AwsSyncClientHandler.execute(AwsSyncClientHandler.java:56)
	at software.amazon.awssdk.services.sts.DefaultStsClient.assumeRole(DefaultStsClient.java:269)
	at software.amazon.awssdk.services.sts.auth.StsAssumeRoleCredentialsProvider.getUpdatedCredentials(StsAssumeRoleCredentialsProvider.java:71)
	at software.amazon.awssdk.services.sts.auth.StsCredentialsProvider.updateSessionCredentials(StsCredentialsProvider.java:88)
	at software.amazon.awssdk.utils.cache.CachedSupplier.lambda$jitteredPrefetchValueSupplier$3(CachedSupplier.java:283)
	at software.amazon.awssdk.utils.cache.CachedSupplier$PrefetchStrategy.fetch(CachedSupplier.java:419)
	at software.amazon.awssdk.utils.cache.CachedSupplier.refreshCache(CachedSupplier.java:198)
	at software.amazon.awssdk.utils.cache.CachedSupplier.get(CachedSupplier.java:127)
	at software.amazon.awssdk.services.sts.auth.StsCredentialsProvider.resolveCredentials(StsCredentialsProvider.java:99)
	at software.amazon.awssdk.services.sts.auth.StsAssumeRoleCredentialsProvider.resolveCredentials(StsAssumeRoleCredentialsProvider.java:43)
	at org.dynamodb4idea.c$a.resolveCredentials(SourceFile:110)
	at org.dynamodb4idea.a.resolveCredentials(SourceFile:117)
	at software.amazon.awssdk.core.internal.util.MetricUtils.measureDuration(MetricUtils.java:50)
	at software.amazon.awssdk.awscore.internal.authcontext.AwsCredentialsAuthorizationStrategy.resolveCredentials(AwsCredentialsAuthorizationStrategy.java:100)
	at software.amazon.awssdk.awscore.internal.authcontext.AwsCredentialsAuthorizationStrategy.addCredentialsToExecutionAttributes(AwsCredentialsAuthorizationStrategy.java:77)
	at software.amazon.awssdk.awscore.internal.AwsExecutionContextBuilder.invokeInterceptorsAndCreateExecutionContext(AwsExecutionContextBuilder.java:120)
	at software.amazon.awssdk.awscore.client.handler.AwsSyncClientHandler.invokeInterceptorsAndCreateExecutionContext(AwsSyncClientHandler.java:69)
	at software.amazon.awssdk.core.internal.handler.BaseSyncClientHandler.lambda$execute$1(BaseSyncClientHandler.java:78)
	at software.amazon.awssdk.core.internal.handler.BaseSyncClientHandler.measureApiCallSuccess(BaseSyncClientHandler.java:179)
	at software.amazon.awssdk.core.internal.handler.BaseSyncClientHandler.execute(BaseSyncClientHandler.java:76)
	at software.amazon.awssdk.core.client.handler.SdkSyncClientHandler.execute(SdkSyncClientHandler.java:45)
	at software.amazon.awssdk.awscore.client.handler.AwsSyncClientHandler.execute(AwsSyncClientHandler.java:56)
	at software.amazon.awssdk.services.dynamodb.a.listTables(SourceFile:5145)
	at software.amazon.awssdk.services.dynamodb.DynamoDbClient.listTables(DynamoDbClient.java:5787)
	at org.dynamodb4idea.lH$g.a(SourceFile:143)
	at org.dynamodb4idea.lH$g.invoke(SourceFile:146)
	at org.dynamodb4idea.p.a(SourceFile:24)
	at org.dynamodb4idea.p.b(SourceFile:49)
	at org.dynamodb4idea.q$a.run(SourceFile:27)
	at com.intellij.openapi.progress.impl.CoreProgressManager.startTask(CoreProgressManager.java:429)
	at com.intellij.openapi.progress.impl.ProgressManagerImpl.startTask(ProgressManagerImpl.java:114)
	at com.intellij.openapi.progress.impl.CoreProgressManager.lambda$runProcessWithProgressAsynchronously$6(CoreProgressManager.java:480)
	at com.intellij.openapi.progress.impl.ProgressRunner.lambda$submit$3(ProgressRunner.java:252)
	at com.intellij.openapi.progress.impl.CoreProgressManager.lambda$runProcess$2(CoreProgressManager.java:186)
	at com.intellij.openapi.progress.impl.CoreProgressManager.lambda$executeProcessUnderProgress$13(CoreProgressManager.java:604)
	at com.intellij.openapi.progress.impl.CoreProgressManager.registerIndicatorAndRun(CoreProgressManager.java:679)
	at com.intellij.openapi.progress.impl.CoreProgressManager.computeUnderProgress(CoreProgressManager.java:635)
	at com.intellij.openapi.progress.impl.CoreProgressManager.executeProcessUnderProgress(CoreProgressManager.java:603)
	at com.intellij.openapi.progress.impl.ProgressManagerImpl.executeProcessUnderProgress(ProgressManagerImpl.java:60)
	at com.intellij.openapi.progress.impl.CoreProgressManager.runProcess(CoreProgressManager.java:173)
	at com.intellij.openapi.progress.impl.ProgressRunner.lambda$submit$4(ProgressRunner.java:252)
	at java.base/java.util.concurrent.CompletableFuture$AsyncSupply.run(CompletableFuture.java:1768)
	at java.base/java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1136)
	at java.base/java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:635)
	at java.base/java.util.concurrent.Executors$PrivilegedThreadFactory$1$1.run(Executors.java:702)
	at java.base/java.util.concurrent.Executors$PrivilegedThreadFactory$1$1.run(Executors.java:699)
	at java.base/java.security.AccessController.doPrivileged(AccessController.java:399)
	at java.base/java.util.concurrent.Executors$PrivilegedThreadFactory$1.run(Executors.java:699)
	at java.base/java.lang.Thread.run(Thread.java:833)
Caused by: java.lang.IllegalStateException: Command returned non-zero exit value (127) with error message: sh: saml2aws: command not found

	at software.amazon.awssdk.auth.credentials.ProcessCredentialsProvider.executeCommand(ProcessCredentialsProvider.java:215)
	at software.amazon.awssdk.auth.credentials.ProcessCredentialsProvider.refreshCredentials(ProcessCredentialsProvider.java:126)
	... 63 more

@fjaccarino
Copy link
Author

fjaccarino commented Mar 29, 2023 •
edited
Loading

Additionally, when launched from the CLI, the connection seems to inspect DynamoDB resources just fine but when I try a query I see the following:

AccessDeniedException
User: arn:aws:sts::<<account number>>:assumed-role/<<role name>>/aws-sdk-java-1680121851194 is not authorized to perform: dynamodb:Query on resource: arn:aws:dynamodb:us-east-1:<<account number>>:table/<<table name>> because no identity-based policy allows the dynamodb:Query action

My role certainly does not contain the aws-sdk-java-1680121851194 text in the arn path. Is that normal?
The text up until that point properly reflects the role though:
arn:aws:sts::<<account number>>:assumed-role/<<role name>>

@AntonShuvaev
Copy link
Owner

Thanks for the info, I will look into it.

@AntonShuvaev AntonShuvaev added the bug Something isn't working label Mar 30, 2023
@fjaccarino
Copy link
Author

Much appreciated.

@fjaccarino
Copy link
Author

Curious when you think you'll get to looking into this. It's an unfortunate full blocker at the moment.

@AntonShuvaev
Copy link
Owner

I'm going to release a fix next week.

@fjaccarino
Copy link
Author

Excellent. Looking forward to it.

@AntonShuvaev
Copy link
Owner

This bug is fixed now, please update to 2023.1.1.

Regarding the AccessDeniedException error, aws-sdk-java-1680121851194 is the name of the temporary session which is added by AWS SDK if it is not already present. It shouldn't be a problem as long as the role has the correct permissions and there is no condition for sts:RoleSessionName.

Can you check with AWS CLI if you can run the same query?

@fjaccarino
Copy link
Author

I no longer see the java.lang.IllegalStateException: Failed to refresh process-based credentials error but still see the AccessDeniedException. Same from the CLI. Do you know what permission is required so I can chat with security?

@AntonShuvaev
Copy link
Owner

Thanks for confirming that the error is gone.

You can use AmazonDynamoDBFullAccess policy or set up policy for the specific table.

For reading data you need dynamodb:ListTables, dynamodb:DescribeTable, dynamodb:Query, dynamodb:Scan and dynamodb:ExecuteStatement(for PartiQL) permissions. For managing data you also need dynamodb:UpdateItem, dynamodb:PutItem, dynamodb:DeleteItem and dynamodb:BatchWriteItem permissions.

You can find more details here: https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_examples_dynamodb_specific-table.html

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
bug Something isn't working
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
2 participants
@fjaccarino @AntonShuvaev