-
Notifications
You must be signed in to change notification settings - Fork 4.1k
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
cdk <command> --profile <named profile> tries default regardless #5053
Comments
this problem seems to be triggered when i try to import existing resource of the account into to the stack. Such as when I make |
@shivlaks Yes I did. My case is ok to deploy with profile. So that works. But the problem is I am using methods such as ec2.Vpc.from_lookup(), so cdk will need to login to aws to get the existing resource info. That's where the problem came up. I didnt try the plug-in.. Thought the CDK should work natively with the profile.... |
@dxunix I see what you mean. I'll have to give that a repro, but please let me know if the plugin works for you. |
@shivlaks: Ok. i have a feeling this something to do with vpc only without specify the account id works in other from*** methods for other resources. vpc needs account id. thus i got the error.
add account to env
also worth noting is: we are using saml to get the keys. therefore, there is a token as well. I dont know if this is the reason it is off. |
@dxunix does running the command with |
@shivlaks , see the verbose output. The credential is fed in from the env variables including TOKEN.
|
@shivlaks Is there a plan to fix bugs like these? |
This solution is works for me: ~/.aws/config
~/.aws/credentials
command to deploy: Environment
|
@dxunix yes, but i'm still a little unclear on the repro steps... what does your stack code look like (particularly environment setup and where you're attempting to use the fromLookup). I'm also curious what your |
@shivlaks I have the same issue. It seems that the source_profile in ~/.aws/config does not use the corresponding credentials in ~/.aws/credentials. |
@shivlaks I am also seeing this error. It is coming from the context. However, I've destroyed context continuously; i.e. used ACCOUNT_A == default profile
I expect the above. I don't expect the below.
Environment: CDK_CLI_VERSION: '1.51.0' |
Same or similar issue here with cdk 1.57.0. Running
What I did was follow the example provided by AWS: https://docs.aws.amazon.com/cdk/latest/guide/ecs_example.html. But since I want to use an existing VPC, I added this in my_ecs_construct_stack.py:
Maybe there is something else I need to do first? Hard code the account number in the code, or set environment variables is not an acceptable solution for us since we have over 40 accounts to manage. |
We just switched to AWS SSO and ran into this same problem. Our profiles looked similar to what @seekayel posted (but no access keys). Then switched to AWS SSO and getting this same error everyone is reporting, EG:
Maybe this is helpful (from
|
Sorry for the noise, looks like there is another issue tracking AWS SSO: #5455 |
What @tomassommar said is the correct cause of this issue: "It seems that the source_profile in ~/.aws/config does not use the corresponding credentials in ~/.aws/credentials." The CDK CLI seems to search for both the config and credentials with the same name as the profile provided. When the credentials are under a different name than the config, but referenced with "source_profile", it does not work. |
cdk bootstrap aws://ACCOUNT/REGION --profile PROFILENAME seems pretty straightforward that this should just work but it doesnt failed bootstrapping: Error: Need to perform AWS calls for account 475466387505, but no credentials have been configured i have three profiles configured in ~/.aws/config but no default (removed per debug steps) my credential is an AWS SSO type cdk --version |
Try with the --verbose flag to get the error. In my case, it was |
I am facing exactly the same issue. When passing --profile with
My command looks something like this |
Another case when the credential lookup fails. If you used upper-case for the access key id and secret key in your credentials file, CDK seems to fail. For example, This doesn't work:
but this does:
Note that the AWS CLI itself seems to be case-insensitive but CDK doesn't seem to be. That is, I am able to run |
Exactly, case sensitive problem. My code works after changing to lower case: "aws_access_key_id", etc... Thank @praneetloke |
Hi - I got this to work
then
|
I have the same problem. I have configured my named profile but when I try to
My app is configured to look for
I can list files in my S3 bucket using my named profile
Even without the flag
I
I have two other AWS accounts configured with SSO
I even tried setting the environment variable explicitly in my shell but no luck. What am I missing? Why does CDK not pick up the right profile? What am I doing wrong? |
I am not sure if this will solve your problem. However, I had the same issue when I tried adding a ec2.Vpc() construct. Eventually, what worked for me is the following.
I suspect either I removed some "context" sections thinking they were not needed, or over a period of time new entries were added by CDK. Good luck. |
Hi @dxunix is this bug still relevant? |
This issue has not received a response in a while. If you want to keep this issue open, please leave a comment below and auto-close will be canceled. |
Hello, I can confirm this issue still exists. I notice it just got closed but it is definitely still an issue |
We should not be adding |
Looks like the big issue here is the casing of AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY. This is an issue that appears to continue to be the case in the SDK v3 so our in-progress upgrade will not immediately alleviate it. We'll either need to add custom logic to our credential provider chain or make it explicit in the documentation that these files are case sensitive and must be in lowercase. |
This issue has received a significant amount of attention so we are automatically upgrading its priority. A member of the community will see the re-prioritization and provide an update on the issue. |
cdk commands does not pick up the named profile from
.aws/credential
and./aws/config
. the profile is configured thruaws configure
and in the format as specified in the aws doc. (two files,[<profile name>]
in credential file and[profile <profile name>]
in config file.Reproduction Steps
create the profile
specify account number and region in the stack env.
run cdk synth or cdk deploy with
--profile <profile name>
Error Log
Environment
Other
Also tried to remove the [default] blocks in the .aws/ files, still same error.
This is 🐛 Bug Report
The text was updated successfully, but these errors were encountered: