Panic in ExportAccessTokenToCache when assuming a role-chained profile (role_arn + source_profile)

[IskanderNovena]

Summary

assume panics with a nil pointer dereference in ExportAccessTokenToCache when:

• ExportSSOToken = true is set in ~/.granted/config
• The assumed profile uses role_arn + source_profile (role chaining)
• The SSO session is only defined on the parent (source) profile

The assume itself succeeds (credentials are valid), but the post-assume SSO token export crashes because it looks at the assumed profile for SSO session info rather than traversing the source_profile chain.

Stack trace

[✔] [my-chained-profile](eu-central-1) session credentials will expire in 1 hour

panic: runtime error: invalid memory address or nil pointer dereference
[signal SIGSEGV: segmentation violation code=0x2 addr=0x10 pc=0x102d1c234]

goroutine 1 [running]:
github.com/fwdcloudsec/granted/pkg/cfaws.CreatePlainTextSSO({{0x2d914ce71308, 0x2e}, {{0x0, 0x0}, {0x0, 0x0}, {0x0, 0x0}, {0x0, 0x0}, ...}, ...}, ...)
        github.com/fwdcloudsec/granted/pkg/cfaws/ssotoken.go:42 +0x54
github.com/fwdcloudsec/granted/pkg/cfaws.ExportAccessTokenToCache({0x1034fe6f0, 0x10363fe20}, 0x2d914ceee608)
        github.com/fwdcloudsec/granted/pkg/cfaws/cred_exporter.go:79 +0xe0
github.com/fwdcloudsec/granted/pkg/assume.AssumeCommand(0x2d914ce2c040)
        github.com/fwdcloudsec/granted/pkg/assume/assume.go:488 +0x1f74

Reproduction

~/.granted/config

ExportSSOToken = true

[Keyring]
  Backend = "keychain"

~/.aws/config

[sso-session my-org]
sso_region              = eu-west-1
sso_start_url           = https://my-org.awsapps.com/start/
sso_registration_scopes = sso:account:access

[profile my-org-base]
sso_session    = my-org
sso_account_id = 111111111111
sso_role_name  = MyBaseRole
region         = eu-central-1

[profile my-org-target-account]
role_arn       = arn:aws:iam::222222222222:role/MyRole
source_profile = my-org-base
region         = eu-central-1

Steps

1. granted sso login (authenticate successfully)
2. assume my-org-target-account
3. Credentials resolve successfully, but then panic occurs in ExportAccessTokenToCache

Expected behavior

ExportAccessTokenToCache should traverse the source_profile chain to find the SSO session and export the token, or gracefully skip the export when no SSO session is resolvable on the assumed profile.

Actual behavior

The function looks at the assumed profile directly, finds no SSO session info (all {0x0, 0x0} nil fields in the SSO token struct), and dereferences a nil pointer at ssotoken.go:42.

Related

• Using profiles with session set and no start_url fails when trying to assume with --export-sso-token #571 (similar crash path, fixed for profiles with sso_session set but no sso_start_url on the profile itself)
• Panic error when granted_sso_start_url or granted_sso_region aren't defined #605 (panic when granted_sso_* fields are missing)

Environment

• macOS (Apple Silicon)
• Granted v0.39.0
• Keyring backend: keychain

Workaround

Set ExportSSOToken = false in ~/.granted/config. This prevents the crash but disables the SSO token cache export feature entirely.

[MLuc24]

Two separate defects stacked here, and it is worth separating them because only one of them is the crash.

The segfault is a missing nil check. CreatePlainTextSSO dereferences the token unconditionally:

return &SSOPlainTextOut{
    AccessToken:    token.AccessToken,
    ExpiresAt:      token.Expiry.Format(time.RFC3339),
    Region:         ssoRegion,
    SSOSessionName: awsConfig.SSOSessionName,
    StartUrl:       ssoStartURL,
}

token is a *securestorage.SSOToken, and nothing between the lookup and that line checks it. So any path where no token is found panics rather than failing.

Why it is nil in your case is the real bug, and it is upstream in ExportAccessTokenToCache:

tokenKey := profile.SSOStartURL() + profile.AWSConfig.SSOSessionName
cachedToken := secureSSOTokenStorage.GetValidSSOToken(ctx, tokenKey)

The key is built from the profile being assumed. With role_arn plus source_profile, that profile has no SSO config of its own — the session lives on the parent — so both halves are empty, tokenKey is the empty string, nothing matches, and you get nil. Exactly as you diagnosed: it never traverses the chain.

There is a nice irony a few lines down. CreatePlainTextSSO does handle "not directly on this profile" for two other fields:

ssoRegion := awsConfig.SSORegion
if ssoRegion == "" && awsConfig.SSOSession != nil {
    ssoRegion = awsConfig.SSOSession.SSORegion
}

ssoStartURL := awsConfig.SSOStartURL
if ssoStartURL == "" && awsConfig.SSOSession != nil {
    ssoStartURL = awsConfig.SSOSession.SSOStartURL
}

So the function already anticipates the values not sitting where you first look — just not for the token key that decides whether there is a token at all.

Worth asking for both in the issue, since fixing only the nil check turns a panic into a silent no-export and leaves role chaining without the cache entry you enabled the setting for. The traversal is the fix; the guard is what stops the next unforeseen empty-key case being a crash.

Related, in case it is useful context for whoever picks this up: the same helper's profile-shaped signature is why granted sso login cannot export the token either. Same root, two symptoms.