CDK 1.20 Unable to determine the default AWS account #5743
Comments
mo-matt-p
added
bug
|
we are experiencing the same regression, but in a different use-case. We are using EC2 instance with attached role and no any AWS profiles / credentials. With 1.18 everything works, upgrading to 1.20 brings an error: |
|
Hi! |
|
We are having the same problem. The following used to work with 1.18.0 but no longer does with 1.20.0. |
MrArnoldPalmer
added
p0
and removed
needs-triage
|
@mo-matt-p are you on an EC2 instance? @ilkomiliev is using an EC2 instance. Wonder if that's the issue. If the problem was an upgrade to The problem should NOT go when you install |
|
1.19.0 was released at the time This change looks more suspicious to me: ac748c1 |
|
@mo-matt-p @ilkomiliev @sheridansmall we are working on reproduction and are having some trouble. In the meantime, you can try something for us and report back if that helps your situation. ac748c1#diff-141bf52cac9079e1dc3291f7624d61bfR99 This function is async and is being called without |
|
also, are any of you using a proxy. That may be why we aren't able to reproduce yet. |
@MrArnoldPalmer I am behind a proxy, yes. Not on an EC2. I will try out your patch tomorrow. Thanks. |
|
I am still unable to reproduce this after trying a number of things. If someone could help provide minimal reproduction code that could help. I'm running the following within a new cdk app to try and reproduce the conditions in a container, but the cli is still resolving default account and credentials as expected. content=$(aws sts get-session-token)
session_token=$(echo $content | jq -r '.Credentials.SessionToken')
access_key_id=$(echo $content | jq -r '.Credentials.AccessKeyId')
secret_access_key=$(echo $content | jq -r '.Credentials.SecretAccessKey')
docker run \
-e "AWS_SESSION_TOKEN=${session_token}" \
-e "AWS_ACCESS_KEY_ID=${access_key_id}" \
-e "AWS_SECRET_ACCESS_KEY=${secret_access_key}" \
-e "AWS_DEFAULT_REGION=us-east-1" \
-v $PWD:/usr/src/app -w /usr/src/app \
node:12 npm run cdk -- -v synth |
|
we are also behind proxy. Additionally, we are using self-signed certificates on it (corporate setup), but this hasn't been changed since it worked. The SSL handling was also setup correctly to trust our certificates. To reproduce, I've just created a new application from the CLI, set the env like this:
and calling the stack, passing this as an env parameter:
|
|
Hi @ilkomiliev, Since we weren't able to reproduce would you be able to try the patch @MrArnoldPalmer suggested #5743 (comment)? |
|
@mo-matt-p, would you mind sharing your code and the full log? Thanks for helping us debug it! |
|
Yes we are using a proxy. |
|
I've also tried to patch it but I'm facing the same problem as @sheridansmall - this call is done in the constructor, so outside async function and await can't be used here |
|
Yeah after investigating yesterday, I'm pretty confident its not a missing await. I added timeouts to try and coax out a repro of a race condition and couldn't. @ilkomiliev @sheridansmall @mo-matt-p can you tell us a bit more about your proxy setups? We may have a regression related to #645 |
|
@MrArnoldPalmer ; not sure what kind of thing you need - I'm no expert in this area - stuff like this? |
|
that does help, thanks! |
|
My testing with a proxy is also working as expected. I'm running an http(s) proxy on my host machine and connecting to it from the docker container. docker run \
-e "AWS_SESSION_TOKEN=${session_token}" \
-e "AWS_ACCESS_KEY_ID=${access_key_id}" \
-e "AWS_SECRET_ACCESS_KEY=${secret_access_key}" \
-e "AWS_DEFAULT_REGION=eu-west-2" \
-e "https_proxy=http://host.docker.internal:8080" \
-e "http_proxy=http://host.docker.internal:8080" \
-v ~/dev/aws-cdk:/usr/src/aws-cdk \
-v $PWD:/usr/src/app -w /usr/src/app \
node:12 /usr/src/aws-cdk/packages/aws-cdk/bin/cdk -v synth@mo-matt-p can you provide a code example for how you are starting your session with boto3 and setting those values to the environment? Is it also possible for you to run your code without the proxy to see if it still breaks? |
|
@ilkomiliev I've tried manually passing the region and account number in the env with credentials under the 'default' aws sdk profile and that works as well. |
|
The if (options.proxyAddress) { // Ignore empty string on purpose
debug('Using proxy server: %s', options.proxyAddress);
httpOptions.proxy = options.proxyAddress;
// missing httpOptions.agent = require('proxy-agent')(options.proxyAddress);
}
if (options.caBundlePath) {
debug('Using ca bundle path: %s', options.caBundlePath);
httpOptions.agent = new https.Agent({ca: await readIfPossible(options.caBundlePath)});
}This was introduced in this commit I was able to reproduce it, and it looks like setting the agent property seems to fix the issue. if (options.proxyAddress) { // Ignore empty string on purpose
logging_1.debug('Using proxy server: %s', options.proxyAddress);
httpOptions.proxy = { agent: require('proxy-agent')(options.proxyAddress) };
}@mo-matt-p & @ilkomiliev While I'm pushing the fix would you like to try patch your CLI version? |
|
if this could help here the output from 1.18 and 1.20. I think that something is missing in the request sent to STS. The app has been generated with the cdk CLI and the only change is: Proxy settings are also nothing special: I don't think that we are experiencing connectivity problems - I think that 500 comes from the STS endpoint, so that we are able to reach it. hope this helps |
|
I think it's the 'http.agent' that missing, it was removed in the commit I mentioned. |
CDK v1.20 does not set
CDK_DEFAULT_ACCOUNTwhenAWS_SESSION_TOKEN,AWS_SECRET_ACCESS_KEY, andAWS_ACCESS_KEY_IDare set in the environment. Works fine in v1.19.I cannot use a CLI profile because my organisation requires MFA authentication; as work around I am starting a session via
boto3and exporting the environment variables.Reproduction Steps
Error Log
Unable to determine the default AWS account
Environment
This is 🐛 Bug Report
The text was updated successfully, but these errors were encountered: