Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Recent change causes profile names with '.' to not be recognized or found #1053

Closed
rvanider opened this issue Oct 24, 2023 · 4 comments · Fixed by #1067 or #1100
Closed

Recent change causes profile names with '.' to not be recognized or found #1053

rvanider opened this issue Oct 24, 2023 · 4 comments · Fixed by #1067 or #1100

Comments

@rvanider
Copy link

https://github.com/awslabs/smithy-typescript/blob/d5eacb5153a8473b572919392e0644babd04d983/packages/shared-ini-file-loader/src/parseIni.ts#L5

While the . character is not cited in https://docs.aws.amazon.com/sdkref/latest/guide/file-format.html#section-types profile names in the format of some-account.some-role were accepted in the aws-sdk-v2 and up until the last change to the above regular expression.

Both the aws cli, aws-sdk-v2 and the Python sdk accept this name pattern. It appears the java SDK was revised to accept these as well via aws/aws-sdk-java-v2#389 and https://github.com/aws/aws-sdk-java-v2/pull/1538/files.

Please revise to improve consistency.

@jmalins
Copy link

jmalins commented Oct 24, 2023

This also broke the profiles generated by granted, which contain a single slash: {aws-account-name}/{role-name}.

@jmalins
Copy link

jmalins commented Oct 24, 2023

This behavior was extremely difficult to trace because profile names containing invalid characters are silently ignored. They work in the AWS CLI, Python SDK and Javascript SDK V2.

In Javascript SDK V3, you simply receive a CredentialsProviderError: Could not load credentials from any providers error without context or explanation.

@huyhua-nvg
Copy link

huyhua-nvg commented Nov 10, 2023

@trivikr unfortunately this doesn't fix the problem.
This part of the code filter out profiles with "." in name even if parseIni returns the correct ones.

https://github.com/awslabs/smithy-typescript/blob/d5eacb5153a8473b572919392e0644babd04d983/packages/shared-ini-file-loader/src/getConfigData.ts#L14-L32

This is how it would work in my case but I'm unaware if it introduces more regressions.

    .filter(([key]) => {
      const sections = key.split(CONFIG_PREFIX_SEPARATOR);
      if (sections.length >= 2 && Object.values(IniSectionType).includes(sections[0] as IniSectionType)) {
        return true;
      }
      return false;
    })
    // replace profile prefix, if present.
    .reduce(
      (acc, [key, value]) => {
        const updatedKey = key.startsWith(IniSectionType.PROFILE) ? key.split(CONFIG_PREFIX_SEPARATOR).slice(1).join(loadSharedConfigFiles_1.CONFIG_PREFIX_SEPARATOR) : key;
        acc[updatedKey] = value;
        return acc;
      },
      {
        // Populate default profile, if present.
        ...(data.default && { default: data.default }),
      } as ParsedIniData
    );

@trivikr
Copy link
Contributor

trivikr commented Dec 5, 2023

Reproduction code

$ cat test.mjs 
import { loadSharedConfigFiles } from "@smithy/shared-ini-file-loader"; // v2.2.6
console.log(await loadSharedConfigFiles());

$ cat ~/.aws/credentials
[foo.bar]
aws_access_key_id = aws_access_key_id
aws_secret_access_key = aws_secret_access_key

[foo@bar]
aws_access_key_id = aws_access_key_id
aws_secret_access_key = aws_secret_access_key

$ cat ~/.aws/config
[profile foo.bar]
region = eu-west-2

[profile foo@bar]
region = eu-west-2

Output

$ node test.mjs 
{
  configFile: { 'foo@bar': { region: 'eu-west-2' } },
  credentialsFile: {
    'foo.bar': {
      aws_access_key_id: 'aws_access_key_id',
      aws_secret_access_key: 'aws_secret_access_key'
    },
    'foo@bar': {
      aws_access_key_id: 'aws_access_key_id',
      aws_secret_access_key: 'aws_secret_access_key'
    }
  }
}

The value at configFile key should be

{
  'foo.bar': { region: 'eu-west-2' },
  'foo@bar': { region: 'eu-west-2' }
}

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
4 participants