Skip to content

fix: role assumption through profiles not working properly in certain situations #14315

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 3 commits into from
Oct 31, 2025
Merged

fix: role assumption through profiles not working properly in certain situations #14315

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
33d514b
fix: downgrade credential-providers
Oct 31, 2025
374537e
fix: expiration in wrong format
Oct 31, 2025
f0e0cf1
chore: removed random import
Oct 31, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion packages/amplify-e2e-core/package.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -42,7 +42,7 @@
"@aws-sdk/client-s3": "^3.919.0",
"@aws-sdk/client-ssm": "^3.919.0",
"@aws-sdk/client-sts": "^3.919.0",
"@aws-sdk/credential-providers": "^3.919.0",
"@aws-sdk/credential-providers": "3.721.0",
"@aws-sdk/lib-dynamodb": "^3.919.0",
"amplify-headless-interface": "1.17.8",
"aws-amplify": "^5.3.16",
Expand Down
2 changes: 1 addition & 1 deletion packages/amplify-e2e-tests/package.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -44,7 +44,7 @@
"@aws-sdk/client-s3": "^3.919.0",
"@aws-sdk/client-ssm": "^3.919.0",
"@aws-sdk/client-sts": "^3.919.0",
"@aws-sdk/credential-providers": "^3.919.0",
"@aws-sdk/credential-providers": "3.721.0",
"@aws-sdk/lib-storage": "^3.919.0",
"@babel/core": "^7.23.2",
"@babel/plugin-transform-modules-commonjs": "7.10.4",
Expand Down
2 changes: 1 addition & 1 deletion packages/amplify-provider-awscloudformation/package.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -59,7 +59,7 @@
"@aws-sdk/client-ssm": "^3.919.0",
"@aws-sdk/client-sts": "^3.919.0",
"@aws-sdk/credential-provider-node": "^3.919.0",
"@aws-sdk/credential-providers": "^3.919.0",
"@aws-sdk/credential-providers": "3.721.0",
"@aws-sdk/lib-dynamodb": "^3.919.0",
"@aws-sdk/lib-storage": "^3.919.0",
"@aws-sdk/s3-request-presigner": "^3.919.0",
Expand Down
3 changes: 3 additions & 0 deletions packages/amplify-provider-awscloudformation/src/index.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -107,6 +107,9 @@ async function getConfiguredAWSClientConfig(context, category, action) {
category = category || 'missing';
action = action || ['missing'];
const userAgentAction = `${category}:${action[0]}`;
if (credsConfig.credentials && credsConfig.credentials.expiration && typeof credsConfig.credentials.expiration === 'string') {
credsConfig.credentials.expiration = new Date(credsConfig.credentials.expiration);
}
const config = {
credentials: credsConfig.credentials || credsConfig,
customUserAgent: formUserAgentParam(context, userAgentAction),
Expand Down
17 changes: 11 additions & 6 deletions packages/amplify-provider-awscloudformation/src/system-config-manager.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -93,7 +93,6 @@ export const getProfiledAwsConfig = async (
...roleCredentials,
};
} else if (profileConfig.credential_process) {
// TO DO: need to revisit this
// need to force AWS_SDK_LOAD_CONFIG to a truthy value to force credential process to prefer the credential process in ~/.aws/config instead of ~/.aws/credentials
const sdkLoadConfigOriginal = process.env.AWS_SDK_LOAD_CONFIG;
process.env.AWS_SDK_LOAD_CONFIG = '1';
Expand Down Expand Up @@ -175,10 +174,12 @@ const getRoleCredentials = async (context: $TSContext, profileName: string, prof

if (roleData.Credentials) {
roleCredentials = {
accessKeyId: roleData.Credentials.AccessKeyId,
secretAccessKey: roleData.Credentials.SecretAccessKey,
sessionToken: roleData.Credentials.SessionToken,
expiration: roleData.Credentials.Expiration,
credentials: {
accessKeyId: roleData.Credentials.AccessKeyId,
secretAccessKey: roleData.Credentials.SecretAccessKey,
sessionToken: roleData.Credentials.SessionToken,
expiration: roleData.Credentials.Expiration,
},
};
}
} catch (ex) {
Expand Down Expand Up @@ -244,7 +245,11 @@ const getCachedRoleCredentials = (roleArn: string, sessionName: string): $TSAny
return undefined;
}
}
return roleCredentials;
return {
credentials: {
...roleCredentials,
},
};
};

const validateCachedCredentials = (roleCredentials: $TSAny): boolean => {
Expand Down
Loading
Loading