Issues with chamber and aws sso

[nitrocode]

I'm having issues with chamber and aws sso

Here is my aws configuration

~/.aws/config

[profile default]
sso_start_url = https://org.awsapps.com/start/
sso_region = us-east-1
sso_account_id = snip
sso_role_name = snip
region = us-east-1
output = json
cli_auto_prompt = on-partial

[profile test]
sso_start_url = https://org.awsapps.com/start/
sso_region = us-east-1
sso_account_id = snip
sso_role_name = snip
region = us-east-1
output = json
cli_auto_prompt = on-partial

It seems to work from awscli correctly

✗ AWS_PROFILE=test aws sts get-caller-identity
{
    "UserId": "snip:snip@snip.com",
    "Account": "snip",
    "Arn": "arn:aws:sts::snip:assumed-role/AWSReservedSSO_Admin_snip/snip@snip.com"
}

For reference, other golang tools work as expected

✗ AWS_PROFILE=test terraform init

Error using the AWS_PROFILE environment variable with chamber

✗ AWS_PROFILE=test chamber list-services
Error: Failed to get secret store: SharedConfigErr: only one credential type may be specified per profile: source profile, credential source, credential process, web identity token, or sso

✗ AWS_PROFILE=test AWS_SDK_LOAD_CONFIG=1 chamber list-services
Error: Failed to get secret store: SharedConfigErr: only one credential type may be specified per profile: source profile, credential source, credential process, web identity token, or sso

If I use aws2-wrap, it works

✗ unset AWS_PROFILE
✗ aws2-wrap --profile test --exec "chamber list-services"
Service
hello-world/secret

It's possible that this is a regression. The previous issue #303 says that the fix for aws sso is in v2.10.0 and I'm using the latest version.

✗ chamber version
chamber v2.12.0

I tried the older version and got the same error

✗ wget https://github.com/segmentio/chamber/releases/download/v2.10.0/chamber-v2.10.0-darwin-amd64
✗ chmod +x chamber-v2.10.0-darwin-amd64
✗ ./chamber-v2.10.0-darwin-amd64 version
chamber v2.10.0

✗ AWS_PROFILE=test AWS_SDK_LOAD_CONFIG=1 ./chamber-v2.10.0-darwin-amd64 list-services
Error: Failed to get secret store: SharedConfigErr: only one credential type may be specified per profile: source profile, credential source, credential process, web identity token, or sso

✗ AWS_PROFILE=test ./chamber-v2.10.0-darwin-amd64 list-services
Error: Failed to get secret store: SharedConfigErr: only one credential type may be specified per profile: source profile, credential source, credential process, web identity token, or sso

I wonder if this problem could be mitigated by using https://github.com/aws/aws-sdk-go-v2 instead of v1

https://aws.github.io/aws-sdk-go-v2/docs/migrating/

Code references

Must be something configured in this block that doesn't respect AWS_PROFILE

chamber/store/shared.go

Lines 34 to 43 in a1f0b44

	retSession, err := session.NewSessionWithOptions(
	session.Options{
	Config: aws.Config{
	Region: region,
	MaxRetries: aws.Int(numRetries),
	EndpointResolver: endpoints.ResolverFunc(endpointResolver),
	},
	SharedConfigState: session.SharedConfigEnable,
	},
	)

Related issues

• not working with AWS SSO? #303
• giving "MissingRegion" error for non existing AWS_PROFILE #274