graceful handling of expired aws sso credentials

[judell]

I'm closing the following in favor of this issue:

turbot/steampipe#1103
#811

The story so far:

1. When SSO credentials have expired, Steampipe takes several minutes to report:

Error: InvalidClientTokenId: The security token included in the request is invalid
        status code: 403, request id: bf386d24-c89a-4880-8db2-16a0c72942bb (SQLSTATE HV000)

2. @dbmurphy has kindly contributed Add sso auto run #847 which aims to automate commands that would otherwise be run manually:

aws sts get-caller-identity --profile PROFILE # check if creds are valid

aws sso login --profile SSO-ReadOnly-605...981 # renew if not

Per #847, there may or may not be a way to automate this flow if the user's setup doesn't accommodate a browser launch.

3. Even when aws sts get-caller-identity --profile PROFILE reports success, if ~/.aws/config looks like this:

[profile SSO-ReadOnly-605...981]
sso_start_url = https://d-9a672b0642.awsapps.com/start
sso_region = us-east-2
sso_account_id = 605...3981
aws_access_key_id="ASIA...2ORLV"
aws_secret_access_key="ATXO...yE49"
aws_session_token="IQo..."
sso_role_name=SSO-ReadOnly

i.e., includes access_key/secret_key/secret_token from the command line or programmatic access link on the SSO start page, then those invalid credentials evidently override and there is again a several-minute timeout before InvalidClientTokenId is reported.

@cbruno10, @dbmurphy are there any other pieces of this puzzle to include here?

[judell]

Update/clarification:

When SSO credentials have expired, Steampipe takes several minutes to report

That's only true if ~/.aws/config has explicit credentials that are expired. Otherwise we promptly report

Error: SSOProviderInvalidToken: the SSO session has expired or is invalid

There's no reason to use explicit credentials, though, and we don't say anything about them here, so unless there's another way to trigger a long delay, I think that the original issue is moot.

Ways to improve:

• A more specific message: "Error: SSOProviderInvalidToken: the SSO session has expired or is invalid. Please run aws sso login --profile PROFILE to reauthorize"

• Automatically kick off the reauth flow (as Add sso auto run #847 aims to do).

[github-actions]

This issue is stale because it has been open 60 days with no activity. Remove stale label or comment or this will be closed in 30 days.

[github-actions]

This issue is stale because it has been open 60 days with no activity. Remove stale label or comment or this will be closed in 30 days.

[github-actions]

This issue is stale because it has been open 60 days with no activity. Remove stale label or comment or this will be closed in 30 days.

[github-actions]

This issue was closed because it has been stalled for 90 days with no activity.