sharedCredentialsFile.RegisterProfile(profile); is throwing "Access Denied" exception on iOS device.

[ahmedanas84]

Describe the bug

Hello,

I'm getting the following exception when I try to create a credential profile on iOS device, It works fine on iOS simulator because this path is not private on MacBook , however, it's private on iOS devices and not accessible.

Access to the path '/private/var/mobile/Containers/Data/Application/7D0A3286-1CB0-4453-840A-D5525E4DBAA1/.aws' is denied.

Also, to add to this I need the profile for "AmazonKeyManagementServiceClient()" The only time it works is by using a profile, using any overloads (like Accesskey, secret key, and region) is causing a crash. I tried all the 12 overloaded parameters and it only works with profile (with no overloads).

public  static void WriteProfile(string profileName, string keyId, string secret, RegionEndpoint region)
    {
        var sharedFile = new SharedCredentialsFile();
       
        if (!File.Exists(sharedFile.FilePath))
        {
            Console.WriteLine($"Create the [{profileName}] profile...");
            var options = new CredentialProfileOptions
            {
                AccessKey = keyId,
                SecretKey = secret,
               
            };
            var profile = new CredentialProfile(profileName, options);
            profile.Region = region;

            sharedFile.RegisterProfile(profile);
        }
    }

Expected Behavior

Create profile with no errors.

Current Behavior

The "RegisterProfile" throw an exception when the app is deployed to an actual iOS device.

Reproduction Steps

Just use the above function to create a profile and use actual iPhone device.

Access to the path '/private/var/mobile/Containers/Data/Application/70E84908-A88D-4B4A-A652-FE0492027F30/.aws' is denied.

at System.IO.FileSystem.CreateDirectory (System.String fullPath) [0x00192] in /Library/Frameworks/Xamarin.iOS.framework/Versions/Current/src/Xamarin.iOS/external/corefx/src/System.IO.FileSystem/src/System/IO/FileSystem.Unix.cs:319
at System.IO.Directory.CreateDirectory (System.String path) [0x0002c] in /Library/Frameworks/Xamarin.iOS.framework/Versions/Current/src/Xamarin.iOS/external/corefx/src/System.IO.FileSystem/src/System/IO/Directory.cs:40
at Amazon.Runtime.Internal.Util.OptimisticLockedTextFile.Persist () [0x0001b] in D:\JenkinsWorkspaces\trebuchet-stage-release\AWSDotNetPublic\sdk\src\Core\Amazon.Runtime\Internal\Util\OptimisticLockedTextFile.cs:75
at Amazon.Runtime.Internal.Util.IniFile.Persist () [0x00006] in D:\JenkinsWorkspaces\trebuchet-stage-release\AWSDotNetPublic\sdk\src\Core\Amazon.Runtime\Internal\Util\IniFile.cs:80
at Amazon.Runtime.CredentialManagement.SharedCredentialsFile.RegisterProfileInternal (Amazon.Runtime.CredentialManagement.CredentialProfile profile) [0x002d3] in D:\JenkinsWorkspaces\trebuchet-stage-release\AWSDotNetPublic\sdk\src\Core\Amazon.Runtime\CredentialManagement\SharedCredentialsFile.cs:305
at Amazon.Runtime.CredentialManagement.SharedCredentialsFile.RegisterProfile (Amazon.Runtime.CredentialManagement.CredentialProfile profile) [0x00059] in D:\JenkinsWorkspaces\trebuchet-stage-release\AWSDotNetPublic\sdk\src\Core\Amazon.Runtime\CredentialManagement\SharedCredentialsFile.cs:244
at HangoutApp.Utilities.WriteProfile (System.String profileName, System.String keyId, System.String secret, Amazon.RegionEndpoint region) [0x00056] in /Volumes/Ahmed/Dayout/Hangout/Hangout/AppCode/Utilities.cs:1368
at HangoutApp.S3ServiceInstance.CreateS3ServiceInstance () [0x00010] in /Volumes/Ahmed/Dayout/Hangout/Hangout/AppCode/S3ServiceInstance.cs:35

Possible Solution

The profile should be saved in other places that allowed in iOS, or it would be better if the "FilePath" property is not read-only so I can set the location myself.

Additional Information/Context

No response

AWS .NET SDK and/or Package version used

AWSSDK 3.7.13.20

Targeted .NET Platform

.NET 6.0.5 (64-bit)

Operating System and version

MACOS Monterey

[ashishdhingra]

Hi @ahmedanas84,

Good afternoon.

Looks like the answer is provided by you in the description itself. I'm unsure why you would attempt to create a profile on a device which is restrictive and does not logically provides access to secured areas of the underlying OS. You should be able to use other overloads of AmazonKeyManagementServiceClient where you are able to provide access and secret key (along with other parameters). Please advise what is expected here since this is not a bug given the platform and functionality you are trying to use.

Converting this issue into discussion since this is not a bug.

Thanks,
Ashish

[ahmedanas84]

I tried the other overloads and it's not working as stated above, it just freezes and crashes. I'm passing the same params to "AmazonKeyManagementServiceClient( App_Settings.NewAWSAccessKey, App_Settings.AWSSecretAccessKey, Amazon.RegionEndpoint.USEast1),

I also created AWSCredentials object not working either. not sure what is the problem. and that's why I used the default profile instead.

[ahmedanas84]

Also just to clarify, when I use the overloads with "AmazonS3Client( App_Settings.NewAWSAccessKey, App_Settings.AWSSecretAccessKey, Amazon.RegionEndpoint.USEast1);" it works with no issues.
When I use the same overload or any other overload with AmazonKeyManagementServiceClient () it just freeze and crash eventually.

[ashishdhingra]

Also just to clarify, when I use the overloads with "AmazonS3Client( App_Settings.NewAWSAccessKey, App_Settings.AWSSecretAccessKey, Amazon.RegionEndpoint.USEast1);" it works with no issues.

When I use the same overload or any other overload with AmazonKeyManagementServiceClient () it just freeze and crash eventually.

@ahmedanas84 You would not be able to write profile to iOS device.

Could you help with below:

• Provide exact error.
• Stack trace.
• What operation are you calling when it freezes and then crashes.
• Does the credentials used above have IAM policy attached to perform specific operation?
• In case you are unable to capture error and stack trace, then May be wrap the call in try/catch block and display these in some iOS dialog (I'm not an iOS developer, so unsure how you would do it).

Thanks,
Ashish

[ahmedanas84]

I found the problem. I wasn't providing the acesskey and secretkey to AmazonS3EncryptionClientV2( config, materials) and it was just freezing the whole thing and I thought it was "AmazonKeyManagementServiceClient" My bad!! Thanks for your time and effort. Have a wonderful day!

[github-actions[bot]]

Hello! Reopening this discussion to make it searchable.