Security Token Invalid when debugging with VS Code and web proxy with self signed CA Certificates

[boyersnet]

Description

Requests to AWS API work as expected when invoking a lambda function from the command line (powershell)

sam local invoke --profile MYPROFILE -e testEvent.json --debug

but fails to execute successfully when executed in VS Code in "Run" or "Debug" via code lens. In my environment variables, I'm passing my CA cert bundle as we are behind a web proxy with SSL "man in the middle". The function works as expected when run in the AWS Web Console.

Steps to reproduce

1. Set the profile in the AWS Toolkit extension
2. Configure the test event and evironment variables by clicking on the configure code lens link and update the json file.
3. Click the Debug Locally code lens link and step through the function.

Observed result

2020-05-13T13:42:32.725Z 97699084-d7f2-1701-a556-18e107b59f4a INFO UnrecognizedClientException: The security token included in the request is invalid. at Request.extractError (/var/runtime/node_modules/aws-sdk/lib/protocol/json.js:51:27) at Request.callListeners (/var/runtime/node_modules/aws-sdk/lib/sequential_executor.js:106:20) at Request.emit (/var/runtime/node_modules/aws-sdk/lib/sequential_executor.js:78:10) at Request.emit (/var/runtime/node_modules/aws-sdk/lib/request.js:683:14) at Request.transition (/var/runtime/node_modules/aws-sdk/lib/request.js:22:10) at AcceptorStateMachine.runTo (/var/runtime/node_modules/aws-sdk/lib/state_machine.js:14:12) at /var/runtime/node_modules/aws-sdk/lib/state_machine.js:26:10 at Request.<anonymous> (/var/runtime/node_modules/aws-sdk/lib/request.js:38:9) at Request.<anonymous> (/var/runtime/node_modules/aws-sdk/lib/request.js:685:12) at Request.callListeners (/var/runtime/node_modules/aws-sdk/lib/sequential_executor.js:116:18) { message: 'The security token included in the request is invalid.', code: 'UnrecognizedClientException', time: 2020-05-13T13:42:27.440Z, requestId: '349615dc-cc68-45a0-8ae0-ab04fcb50aa3', statusCode: 400, retryable: false, retryDelay: 23.370331489961416 } UnrecognizedClientException: The security token included in the request is invalid. at Request.extractError (/var/runtime/node_modules/aws-sdk/lib/protocol/json.js:51:27) at Request.callListeners (/var/runtime/node_modules/aws-sdk/lib/sequential_executor.js:106:20) at Request.emit (/var/runtime/node_modules/aws-sdk/lib/sequential_executor.js:78:10) at Request.emit (/var/runtime/node_modules/aws-sdk/lib/request.js:683:14) at Request.transition (/var/runtime/node_modules/aws-sdk/lib/request.js:22:10) at AcceptorStateMachine.runTo (/var/runtime/node_modules/aws-sdk/lib/state_machine.js:14:12) at /var/runtime/node_modules/aws-sdk/lib/state_machine.js:26:10 at Request.<anonymous> (/var/runtime/node_modules/aws-sdk/lib/request.js:38:9) at Request.<anonymous> (/var/runtime/node_modules/aws-sdk/lib/request.js:685:12) at Request.callListeners (/var/runtime/node_modules/aws-sdk/lib/sequential_executor.js:116:18)

Expected result

I expect the function to execute the AWS API request and return the appropriate response.
var ssmResponse = await ssm.getParameters(params).promise();

Additional environment details (Ex: Windows, Mac, Amazon Linux etc)

1. OS: Windows 10
2. sam --version: 0.48.0

[jfuss]

@boyersnet Since this works on the command line, this appears to be an issue with the Toolkit not SAM CLI. I am not sure how the toolkit works with credentials, so the best course here is to reach out to them: https://github.com/aws/aws-toolkit-vscode/issues. Given the error, it would appear that your credentials are not being passed to SAM CLI as they are in the terminal.

Closing as the command line is work and appears to be a toolkit issue. Please feel free to re-open if that is not the case.

[boyersnet]

Thank you for your feedback @jfuss. Another member of my team documented the issue with the toolkit back in early February.

aws/aws-toolkit-vscode#917 (comment)

While I agree it impacts the toolkit, there is something not working properly with the integration between the toolkit and SAM.

Also, more information here: aws/aws-toolkit-vscode#185