(credentials): (Need to perform AWS calls for account ..., but no credentials have been configured )

[topankefal05]

Describe the bug

With the latest version 2.167.0 I have encountered the issue mentioned in the title. I have been setting the ENV Variables in a pipeline and so far everything has been running smoothly. Since 2.167.0 this doesnt seem to work anymore even though the CredentialsChain suggests to still work in the same way, that it should prioritize fromEnv() if not profile is configured.

Regression Issue

• Select this option if this issue appears to be a regression.

Last Known Working CDK Version

2.166.0

Expected Behavior

Correctly authenticated to complete actions with AWS Account.

Current Behavior

Not authentication identified, no credentials found.

Reproduction Steps

GitLab CI Pipeline with ENV Variables.

Possible Solution

No response

Additional Information/Context

No response

CDK CLI Version

2.167.0

Framework Version

No response

Node.js Version

18.16.1

OS

alpine

Language

TypeScript

Language Version

No response

Other information

No response

[ashishdhingra]

@topankefal05 Your issue appears to be similar to #32120. That issue is being worked upon by CDK team. Hence, please review and advise if it's fine to close this as duplicate.

Thanks,
Ashish

[rix0rrr]

@topankefal05 If you think this is a different issue, we would love some more details from you.

• What type of machine is this on?
• How are you configuring credentials?
• Do you use .aws files? If so, what do they look like?
• Can you run again with -vvv and paste the response?

[topankefal05]

@ashishdhingra After having a look on the other issue it seems to be a duplicate indeed, I will check again if it's resolved with a new version, currently rolling back to 2.166.0 is working.

[alecl]

I have some more information that may help as I got the same error.

I often work with older tools that require .aws/credentials entries including aws_session_token.

For cdk I login via aws sso login --profile $AWS_PROFILE

The issue is cdk deploy will in the credentials provider chain see I have something in .aws/credentials for that profile that's expired and give that priority anyway and an error that it's expired instead of trying the next provider in the chain to get to the SSO one from @aws-sdk/credential-provider-sso which will work fine as I just recently sso logged in vs the .aws/credentials work in that profile I did weeks again but are lingering in the file.

If I delete the entry for the profile in .aws/credentials it works fine via SSO.

In code I have created my own credentials provider to get around this (see below), but I can't nudge cdk itself to do that...

import { AwsCredentialIdentity, Provider } from "@aws-sdk/types";
import { fromSSO } from '@aws-sdk/credential-provider-sso';
import { fromIni } from '@aws-sdk/credential-provider-ini';
import { fromEnv } from '@aws-sdk/credential-provider-env';
import { fromProcess } from '@aws-sdk/credential-provider-process';
import { chain } from '@aws-sdk/property-provider';

type AwsClientConfig = {
    credentials?: Provider<AwsCredentialIdentity>;
    region?: string;
};

function createCustomCredentialProvider(
    profile = 'default'
): Provider<AwsCredentialIdentity> {
    return chain(
        fromSSO({ profile }),
        fromIni({ profile }),
        fromEnv(),
        fromProcess()
    );
}

[scottbisker]

Having a similar issue. SSO works fine in 2.171.0, however, 2.173.0 receive the following error when attempting diff/deploy

Need to perform AWS calls for account XXXXXXXX, but no credentials have been configured

[otaviomacedo]

Seems like a duplicate of #32510.

@scottbisker can you please try with version 2.173.1 or later? It includes a fix for it.

[github-actions]

This issue has not received a response in a while. If you want to keep this issue open, please leave a comment below and auto-close will be canceled.