Fix assuming a role with an AWS profile

lib/plugins/aws/provider/awsProvider.js

@@ -212,7 +212,7 @@ class AwsProvider {
    */
   request(service, method, params, options) {
     const that = this;
-    const credentials = _.cloneDeep(that.getCredentials());
+    const credentials = Object.assign({}, that.getCredentials());
     // Make sure options is an object (honors wrong calls of request)
     const requestOptions = _.isObject(options) ? options : {};
     const shouldCache = _.get(requestOptions, 'useCache', false);

lib/plugins/aws/provider/awsProvider.test.js

@@ -362,6 +362,7 @@ describe('AwsProvider', () => {
           expect(awsProvider.getCredentials().region).to.eql(options.region);
         });
     });
+
     it('should retry if error code is 429', (done) => {
       const error = {
         statusCode: 429,
@@ -767,6 +768,73 @@ describe('AwsProvider', () => {
             requestSpy.restore();
           });
       });
+
+      describe('STS tokens', () => {
+        let newAwsProvider;
+        let originalProviderProfile;
+        let originalEnvironmentVariables;
+        const relevantEnvironment = {
+          AWS_SHARED_CREDENTIALS_FILE: testUtils.getTmpFilePath('credentials'),
+        };
+
+        beforeEach(() => {
+          originalProviderProfile = serverless.service.provider.profile;
+          originalEnvironmentVariables = testUtils.replaceEnv(relevantEnvironment);
+          serverless.utils.writeFileSync(
+            relevantEnvironment.AWS_SHARED_CREDENTIALS_FILE,
+            '[default]\n' +
+            'aws_access_key_id = 1111\n' +
+            'aws_secret_access_key = 22222\n' +
+            '\n' +
+            '[async]\n' +
+            'role_arn = arn:123\n' +
+            'source_profile = default'
+          );
+          newAwsProvider = new AwsProvider(serverless, options);
+        });
+
+        afterEach(() => {
+          testUtils.replaceEnv(originalEnvironmentVariables);
+          serverless.service.provider.profile = originalProviderProfile;
+        });
+
+        it('should retain reference to STS tokens when updated via SDK', () => {
+          const expectedToken = '123';
+
+          serverless.service.provider.profile = 'async';
+          const startToken = newAwsProvider.getCredentials().credentials.sessionToken;
+          expect(startToken).to.not.equal(expectedToken);
+
+          class FakeCloudFormation {
+            constructor(credentials) {
+              // Not sure where the the SDK resolves the STS, so for the test it's here
+              this.credentials = credentials;
+              this.credentials.credentials.sessionToken = expectedToken;
+            }
+
+            describeStacks() {
+              return {
+                send: (cb) => cb(null, {}),
+              };
+            }
+          }
+
+          newAwsProvider.sdk = {
+            CloudFormation: FakeCloudFormation,
+          };
+
+          return newAwsProvider
+            .request('CloudFormation',
+              'describeStacks',
+              { StackName: 'foo' },
+              { region: 'ap-northeast-1' })
+            .then(() => {
+              // STS token is resolved after SDK call
+              const actualToken = newAwsProvider.getCredentials().credentials.sessionToken;
+              expect(expectedToken).to.eql(actualToken);
+            });
+        });
+      });
     });
   });
 
@@ -776,22 +844,6 @@ describe('AwsProvider', () => {
       'aws-sdk': awsStub,
     });
 
-    function replaceEnv(values) {
-      const originals = {};
-      for (const key of Object.keys(values)) {
-        if (process.env[key]) {
-          originals[key] = process.env[key];
-        } else {
-          originals[key] = 'undefined';
-        }
-        if (values[key] === 'undefined') {
-          delete process.env[key];
-        } else {
-          process.env[key] = values[key];
-        }
-      }
-      return originals;
-    }
 
     // add environment variables here if you want them cleared prior to your test and restored
     // after it has completed.  Any environment variable that might alter credentials loading
@@ -828,7 +880,7 @@ describe('AwsProvider', () => {
     beforeEach(() => {
       originalProviderCredentials = serverless.service.provider.credentials;
       originalProviderProfile = serverless.service.provider.profile;
-      originalEnvironmentVariables = replaceEnv(relevantEnvironment);
+      originalEnvironmentVariables = testUtils.replaceEnv(relevantEnvironment);
       // make temporary credentials file
       serverless.utils.writeFileSync(
         relevantEnvironment.AWS_SHARED_CREDENTIALS_FILE,
@@ -849,7 +901,7 @@ describe('AwsProvider', () => {
     });
 
     afterEach(() => {
-      replaceEnv(originalEnvironmentVariables);
+      testUtils.replaceEnv(originalEnvironmentVariables);
       serverless.service.provider.profile = originalProviderProfile;
       serverless.service.provider.credentials = originalProviderCredentials;
     });

tests/utils/index.js

@@ -219,4 +219,21 @@ module.exports = {
   removeService() {
     execSync(`${serverlessExec} remove`, { stdio: 'inherit' });
   },
+
+  replaceEnv(values) {
+    const originals = {};
+    for (const key of Object.keys(values)) {
+      if (process.env[key]) {
+        originals[key] = process.env[key];
+      } else {
+        originals[key] = 'undefined';
+      }
+      if (values[key] === 'undefined') {
+        delete process.env[key];
+      } else {
+        process.env[key] = values[key];
+      }
+    }
+    return originals;
+  },
 };