#1348 - map subprocess stderr to caller stderr

[bwalding]

No description provided.

[jamesls]

Can you share the motivation for this PR? The stderr is included in the exception that's raised, I'm a little hesitant to change this without a good reason.

[thatrevguy]

Hello @jamesls I just tracked this issue down. Not sure about @bwalding but this becomes a problem when credential_process launches an interactive CLI tool. An example would be SAML auth prompting for MFA option.

[lorengordon]

Linking the issue for the requested info on motivation... #1348

[lorengordon]

@jamesls Need anything more on this one? It would really help if we could see MFA prompts when using credential_process, and such prompts seem to be often passed through stderr...

[lorengordon]

@jamesls @JordonPhillips Another use case where stderr getting swallowed makes it much harder to process MFA prompts (particularly when called via credential_process), segmentio/aws-okta#143. Anything we can do to unblock this pr?

[twooster]

Plus one to this. I just wrote a similar patchset for this before checking the PRs, after spending several hours writing something similar to segment's aws-okta command mentioned above. I would love to see this in the aws cli to simplify MFA workflows.

My patchset checks if stdin/stderr are ttys, and only then pass them through. Would this be an acceptable solution to the maintainers?

[edulop91]

FWIW AWS libraries in other languages already do this:
https://github.com/aws/aws-sdk-go/blob/master/aws/credentials/processcreds/provider.go#L347

[moritzheiber]

Can we please merge this PR? This is literally breaking pretty much all of the tooling that needs to request more details before providing credentials. If there's anything that still needs to be done I'm happy to volunteer.

[bwalding]

Closing because this problem doesn't impact me any more (and having it in my dashboard was becoming irksome) - if someone else wants to clone it - please do.