Calling AddSystemsManager using a profile that assumes role throws exception

[kpenergy]

Description

When using a profile that assumes a role (no MFA involved), calling the AddSystemsManager extension method from within Visual Studio 2019 using the Mock Lambda Test Tool throws an exception:

System.InvalidOperationException: 'Assembly AWSSDK.SecurityToken could not be found or loaded. This assembly must be available at runtime to use Amazon.Runtime.AssumeRoleAWSCredentials.'

I'd expect that the correct role is assumed and the relevant parameters are fetched when calling the AddSystemsManager extension method. I think this is a bug as I cant see anything wrong on my end.

There's a similar issue open, #155, however the comments on it suggest that is specifically an issue because of MFA. The issue I'm facing has nothing to do with MFA (or at least, neither my account nor my credentials profile uses any MFA).

Reproduction Steps

Credentials file

[default]
aws_access_key_id=my_key
aws_secret_access_key=my_secret
region=eu-west-1

[profile-assumes-role]
role_arn = arn:aws:iam::my_account:role/my_role
source_profile = default
region=eu-west-1

appsettings.Development.json file

{
  "AWS": {
    "Region": "eu-west-1",
    "Profile": "profile-assumes-role"
  }
}

Code

public class Function
{
    public void FunctionHandler()
    {
        var config = new ConfigurationBuilder()
            .SetBasePath(Directory.GetCurrentDirectory())
            .AddJsonFile("appsettings.Development.json")
            .AddSystemsManager("/path-to-parameters/") // throws ex after brief wait
            .Build();
    }
}

Project Dependencies

<PackageReference Include="Amazon.Extensions.Configuration.SystemsManager" Version="2.1.0" />
<PackageReference Include="Amazon.Lambda.Core" Version="1.2.0" />
<PackageReference Include="Amazon.Lambda.Serialization.SystemTextJson" Version="2.1.0" />
<PackageReference Include="AWSSDK.Extensions.NETCore.Setup" Version="3.7.0.1" />
<PackageReference Include="Microsoft.Extensions.Configuration" Version="5.0.0" />
<PackageReference Include="Microsoft.Extensions.Configuration.FileExtensions" Version="5.0.0" />
<PackageReference Include="Microsoft.Extensions.Configuration.Json" Version="5.0.0" />

Logs

Not sure how to get logs. The link mentioned in the bug template is specifically for .Net Framework. It points me to another page for .Net Core which has no information on logging.

Environment

• Build Version: See dependency versions above
• OS Info: Windows 10
• Build Environment: Visual Studio 2019
• Targeted .NET Platform: .Net Core 3.1

Resolution

• 👋 I can/would-like-to implement a fix for this problem myself

This comment on issue #155 mention that AWSSDK.SecurityToken assembly needs to be added to the list of dependencies, however there would be further issues with MFA because the Lambda tooling doesnt support a prompt for MFA token. Perhaps this assembly should be added as a dependency regardless of the missing MFA prompt, which may fix the issue I'm seeing?

---

This is a 🐛 bug-report

[chrisoverzero]

Hasn't the error message told you the solution?

Assembly AWSSDK.SecurityToken could not be found or loaded.

In order to assume roles, AWSSDK libraries need this assembly. It's available on NuGet under that name. Consider adding it as a development dependency:

<!-- whatever version is appropriate -->
<PackageReference Include="AWSSDK.SecurityToken" Version="3.7.*" PrivateAssets="All" />

[kpenergy]

I really didnt want to introduce this dependency for the sake of testing the code locally, when it's not required while the code is running within the AWS environment.

I ended up settling for a conditional dependency, so the package is only included when building using the debug config (typically while developing/testing locally), but is excluded when building using any other config, such as release (typically when deploying to the AWS environment).

<ItemGroup Condition=" '$(Configuration)' == 'debug' ">
    <PackageReference Include="AWSSDK.SecurityToken" Version="3.7.1.18" />
</ItemGroup>

[chrisoverzero]

I really didnt want to introduce this dependency for the sake of testing the code locally, when it's not required while the code is running within the AWS environment.

Oh, no worries there. Development dependencies (PrivateAssets="All") don't get deployed.

[normj]

As @chrisoverzero said this is how the .NET SDK works is your project has to have the dependency to AWSSDK.SecurityToken for the SDK to find it at runtime. Looks like you have your work around adding the dependency in debug mode.

[github-actions]

⚠️COMMENT VISIBILITY WARNING⚠️

Comments on closed issues are hard for our team to see.
If you need more assistance, please either tag a team member or open a new issue that references this one.
If you wish to keep having a conversation with other community members under this issue feel free to do so.