Credentials behaviour change vs SDK v2 - config source_profile & mfa_serial

[rphippswiley]

With ~/.aws/config:

[baseprofile]
region = eu-west-1
output = json

[profile devel]
role_arn = arn:aws:iam::blahblah
source_profile = baseprofile
mfa_serial = arn:aws:iam::blahblah

Note both source_profile and mfa_serial in devel profile.

My assume role script:

# collect profile + MFA token
profilename=$1
token=$2
RoleARN=$(aws configure get role_arn --profile "${profilename}" --output text)
echo $RoleARN
mfa=$(aws configure get mfa_serial --profile "${profilename}" --output text)
echo $mfa

# generate access tokens
Credentials=$(aws sts assume-role --role-arn "${RoleARN}" --serial-number "${mfa}" --token-code "${token}" --role-session-name "TempSession" --profile "baseprofile" --duration-seconds 28800)
SecretAccessKey=$(echo $Credentials | python3 -c 'import json,sys;obj=json.load(sys.stdin);print(obj["Credentials"]["SecretAccessKey"]);')
SessionToken=$(echo $Credentials | python3 -c 'import json,sys;obj=json.load(sys.stdin);print(obj["Credentials"]["SessionToken"]);')
AccessKeyId=$(echo $Credentials | python3 -c 'import json,sys;obj=json.load(sys.stdin);print(obj["Credentials"]["AccessKeyId"]);')

# set access tokens in `~/.aws/credentials`
aws configure set aws_access_key_id $AccessKeyId --profile $profilename
aws configure set aws_secret_access_key $SecretAccessKey --profile $profilename
aws configure set aws_session_token $SessionToken --profile $profilename

Using JS SDK v2 lib, it automatically picks up the relevant profile tokens in ~/.aws/credentials. ✅

Using JS SDK v3 lib, it will ask for an MFA ❌

If I remove source_profile it correctly reads the tokens from ~/.aws/credentials !

versions (if it matters much)
SDK v2 : aws-sdk@2.1303.0
SDK v3:
"@aws-sdk/client-ssm": "^3.329.0",
"@aws-sdk/node-http-handler": "^3.329.0",

Basic usage:
Env var : AWS_PROFILE=devel

    import { SSMClient, GetParameterCommand } from '@aws-sdk/client-ssm';
    import { NodeHttpHandler } from '@aws-sdk/node-http-handler';
    this.ssm = new SSMClient({
      apiVersion: '2014-11-06',
      region: 'eu-west-1',
      requestHandler: new NodeHttpHandler({
        connectionTimeout: 3000,
        socketTimeout: 3000,
      }),
    });
    const command = new GetParameterCommand({
      Name: 'name',
      WithDecryption: true,
    });
      const response = await this.ssm.send(command);

[rphippswiley]

Updated description to be clearer / new info