-
Notifications
You must be signed in to change notification settings - Fork 1.1k
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Attempting to fetch credentials via iam-role
(AWS SSO) is failing due to leading to an unreachable host
#3030
Comments
iam-role
(AWS SSO) is failing due to leading to an unreachable hostiam-role
(AWS SSO) is failing due to leading to an unreachable host
Hi @b-carneiro, thanks for reaching out. Could you tell me more about how you're setting up AWS SSO and retrieving your credentials? Are you able to successfully log in to your SSO profile? I'd also recommend updating your versions of Boto3 and Botocore, as they are very out of date. Thanks! |
Greetings! It looks like this issue hasn’t been active in longer than five days. We encourage you to check if this is still an issue in the latest release. In the absence of more information, we will be closing this issue soon. If you find that this is still a problem, please feel free to provide a comment or upvote with a reaction on the initial post to prevent automatic closure. If the issue is already closed, please feel free to open a new one. |
Hi @RyanFitzSimmonsAK, I should have given further clarification about the botocore and boto3 versions I listed. They were from a virtualenv in which I was trying to run an application with which I was having this issue. In hindsight, I should have tested this outside the virtualenv. I thought I had. Because yeah, I just did so, and it works fine. It was a problem with that old version of botocore, indeed, and it doesn't happen in the newest version. So I think we can close this issue. |
|
@RyanFitzSimmonsAK I'm getting a similar error where I setup my IAM user and access through IAM identity center. Even after doing |
Sure, here is some documentation that might be useful. |
Thank you @RyanFitzSimmonsAK. I think I was able to resolve the issue. I needed to do |
Describe the bug
When trying to get credentials using AWS SSO, triggering the
iam-role
credentials provider, no credentials are returned. Later, when boto3 tries to actually use the credentials, since no credentials exist, a botocore.exceptions.NoCredentialsError is obtained.Expected Behavior
Valid credentials should be obtained through the
iam-role
credentials provider via AWS SSO, just like it's working in other languages currently (e.g. I tested it in Go viaaws-sdk-go
).Current Behavior
The provider seems to start a connection to
http://169.254.169.254:80
to attempt to fetch a token, but that host is unreachable.Debug output:
Reproduction Steps
The code example below attempts to fetch a secret from Secrets Manager, with debug logs for the core boto libs enabled.
You do need to have AWS IAM Identity Center set up in your account in order to reproduce this.
The environment variables needed to trigger AWS SSO authentication, as well as the secret name and AWS region, are set at the beginning of the code.
The code does gracefully handle the case where the secret does not exist, if authentication happens to be successful.
Possible Solution
There might be some issue with how the host for the token generation is being obtained. I honestly have no idea about why this issue is happening, but it clearly doesn't seem to be a widespread issue (e.g. a widespread outage at the token generation service) as it doesn't happen on other implementations of the AWS SDK (i.e.
aws-sdk-go
on Go).Additional Information/Context
This is a regression. It didn't use to happen in a prior version. Unfortunately I'm not aware of which exact version that is since I've updated botocore long before I've encountered this issue.
SDK version used
botocore v1.14.17
Environment details (OS name and version, etc.)
Ubuntu 22.04.1, Python 3.10.12, boto3 v1.11.5, urllib3 v1.24.3
The text was updated successfully, but these errors were encountered: