[notice] CDK CLI Authentication Issues

[rix0rrr]

The CDK CLI has some limitations compared to the AWS CLI. If you are having authentication issues, they might be covered by one of the following issues. Please use this thread to discuss further.

CDK CLI will not read your region from your [default] profile

If your ~/.aws/config is set up like this:

[default]
region = us-east-1

[profile MyProfile]
role_arn = arn:aws:iam::123456789012:role/myprofile
source_profile = SomeOtherProfile

Even though your profile MyProfile does not contain a region, the AWS CLI will read the region from the [default] section. The AWS SDK for JavaScript that the CDK is built on does not do this, so the CDK does not support this. Make sure every profile section contains the region.

Cannot have a profile named "default" in the config file

The following will not work:

[default]
...

[profile default]
...

The AWS CLI seems to accept this, but the AWS SDK for JavaScript will fail to load the configuration file properly.

How to properly select AWS CLI profiles for your stacks/accounts

See issue #3961

[vschumaker]

I ran in to the case where a [profile default] of the following format

[default]
output = text
region = us-east-1

[profile default]
role_arn = arn:aws:iam::123456789012:role/myrole
source_profile = default

[profile dev]
source_profile = default
role_arn = arn:aws:iam::987654321012:role/myrole
region = us-east-1

caused the following error, even though my AWS_PROFILE environment variable was set to dev

cdk deploy
Need to perform AWS calls for account unknown-account, but no credentials found. Tried: default credentials.

Removing the [profile default] section allowed me to successfully cdk deploy my stack.

[moofish32]

I'm trying to run npm run integ I have my assume role credentials sourced in the following env vars:

AWS_ACCESS_KEY_ID=xxxxx
AWS_SECRET_ACCESS_KEY=xxxx
AWS_SESSION_TOKEN=xxxx

Is there any reason I would still get an error like:

Trying to deploy ec2/integ.event-task.lit.js
[Error at /aws-ecs-integ-ecs/Vpc] Cannot determine scope for context provider availability-zones with props: account=undefined,region=us-west-2.

Is there a new process for running integ tests?

[moofish32]

Answering my own question for the next person.

My issue was that at some point ~/.aws/config added a similar file to the example above. I deleted the ~/.aws/config because I no longer use it and set the AWS_DEFAULT_REGION=xxxx env var in my shell. After that everything started working. @rix0rrr actually found this. So if you have ~/.aws/credentials and ~/.aws/config they both can't have a default profile section.

[0xdevalias]

Another edge case, in case anyone else runs into it. Using aws-vault

⇒  aws-vault exec myprofile -- cdk diff
Need to perform AWS calls for account unknown-account, but no credentials found. Tried: default credentials.

Looking at ~/.aws/config I had an empty profile: [profile myprofile]

By changing it to include a region, the issue was resolved and cdk diff worked as expected:

[profile myprofile]
region=ap-southeast-2

Maybe updating the error message to be a bit more explicit in what the actual issue is would be helpful?

[r-kuhr]

Just to add on for MFA:

I am having this problem WITHOUT a [profile default] entry. Any idea why I am getting the same error?

[default]
region = eu-central-1

[profile int-server]
source_profile = default
role_arn = arn:aws:iam::121212121212:role/deployer
mfa_serial = arn:aws:iam::421212121212:mfa/me@mfa.eu

[profile prod-server]
source_profile = default
role_arn = arn:aws:iam::321212121212:role/deployer
mfa_serial = arn:aws:iam::421212121212:mfa/me@mfa.eu

error:

Setting "aws:cdk:toolkit:default-region" context to eu-central-1
Resolving default credentials
Unable to determine the default AWS account (did you configure "aws configure"?): { AccessDenied: Access denied

[LechuckThePirate]

Hello... I'm having another authentication issue...

We use a identity account and a governor account role with MFA enabled... my config file looks like this:

[profile default]
region=eu-west-1
role_arn=arn:aws:iam::xxxxxxxxxxxxx:role/xxxxxxxx
mfa_serial=arn:aws:iam::xxxxxxxxxxxx:mfa/xxxxxxxxx@xxxxxx.com
source_profile=default

and I have a [default] credentials with my client and secret keys.

I'm running CDK from a AWS Workspace (I don't know if this can be the problem). I get an error saying that I didn't do aws configure ... I did, and I'm providing --profile default to be sure.

Any fix/workaround?

If I try to deploy the hello-cdk app I get this (with --verbose)

PS > cdk deploy --profile default -v
CDK toolkit version: 0.27.0 (build 7638a58)
Command line arguments: { _: [ 'deploy' ],
  trace: false,
  strict: false,
  'ignore-errors': false,
  ignoreErrors: false,
  json: false,
  j: false,
  verbose: true,
  v: true,
  ec2creds: undefined,
  i: undefined,
  'version-reporting': undefined,
  versionReporting: undefined,
  'path-metadata': true,
  pathMetadata: true,
  'asset-metadata': true,
  assetMetadata: true,
  ci: false,
  version: false,
  help: false,
  h: false,
  exclusively: false,
  e: false,
  profile: 'default',
  'role-arn': undefined,
  r: undefined,
  roleArn: undefined,
  'build-exclude': [],
  E: [],
  buildExclude: [],
  '$0': '..\\..\\..\\AppData\\Roaming\\npm\\node_modules\\aws-cdk\\bin\\cdk',
  app: undefined,
  context: undefined,
  plugin: undefined,
  rename: undefined,
  proxy: undefined,
  'toolkit-stack-name': undefined,
  'require-approval': undefined,
  STACKS: [] }
Determining whether we're on an EC2 instance.
cdk.json: {
  "app": "node bin/testapp.js"
}
Setting "aws:cdk:toolkit:default-region" context to undefined
Resolving default credentials
Looks like EC2 instance.
Looking up default account ID from STS
Unable to determine the default AWS account (did you configure "aws configure"?): { InvalidClientTokenId: The security token included in the request is invalid.
    at Request.extractError (D:\xxxxxxxxxxxxxx\AppData\Roaming\npm\node_modules\aws-cdk\node_modules\aws-sdk\lib\protocol\query.js:50:29)
    at Request.callListeners (D:\xxxxxxxxxxxxxx\AppData\Roaming\npm\node_modules\aws-cdk\node_modules\aws-sdk\lib\sequential_executor.js:106:20)
    at Request.emit (D:\xxxxxxxxxxxxxx\AppData\Roaming\npm\node_modules\aws-cdk\node_modules\aws-sdk\lib\sequential_executor.js:78:10)
    at Request.emit (D:\xxxxxxxxxxxxxx\AppData\Roaming\npm\node_modules\aws-cdk\node_modules\aws-sdk\lib\request.js:683:14)
    at Request.transition (D:\xxxxxxxxxxxxxx\AppData\Roaming\npm\node_modules\aws-cdk\node_modules\aws-sdk\lib\request.js:22:10)
    at AcceptorStateMachine.runTo (D:\xxxxxxxxxxxxxx\AppData\Roaming\npm\node_modules\aws-cdk\node_modules\aws-sdk\lib\state_machine.js:14:12)
    at D:\xxxxxxxxxxxxxx\AppData\Roaming\npm\node_modules\aws-cdk\node_modules\aws-sdk\lib\state_machine.js:26:10
    at Request.<anonymous> (D:\xxxxxxxxxxxxxx\AppData\Roaming\npm\node_modules\aws-cdk\node_modules\aws-sdk\lib\request.js:38:9)
    at Request.<anonymous> (D:\xxxxxxxxxxxxxx\AppData\Roaming\npm\node_modules\aws-cdk\node_modules\aws-sdk\lib\request.js:685:12)
    at Request.callListeners (D:\xxxxxxxxxxxxxx\AppData\Roaming\npm\node_modules\aws-cdk\node_modules\aws-sdk\lib\sequential_executor.js:116:18)
  message: 'The security token included in the request is invalid.',
  code: 'InvalidClientTokenId',
  time: 2019-04-01T10:23:27.706Z,
  requestId: '30626f19-5468-11e9-b302-4524a75e3687',
  statusCode: 403,
  retryable: false,
  retryDelay: 16.893920433979147 }
Setting "aws:cdk:toolkit:default-account" context to undefined
context: { 'aws:cdk:toolkit:default-region': undefined,
  'aws:cdk:toolkit:default-account': undefined,
  'aws:cdk:enable-path-metadata': true,
  'aws:cdk:enable-asset-metadata': true }
outdir: D:\xxxxxxxxxxxxxx\AppData\Local\Temp\cdkYL2v9X
outfile: D:\xxxxxxxxxxxxxx\AppData\Local\Temp\cdkYL2v9X\cdk.out
{ version: '0.19.0',
  artifacts: 
   { TestappStack: 
      { type: 'aws:cloudformation:stack',
        environment: 'aws://unknown-account/unknown-region',
        properties: [Object],
        metadata: [Object] } },
  runtime: 
   { libraries: 
      { '@aws-cdk/cdk': '0.27.0',
        '@aws-cdk/cx-api': '0.27.0',
        '@aws-cdk/aws-s3': '0.27.0',
        '@aws-cdk/aws-events': '0.27.0',
        '@aws-cdk/aws-iam': '0.27.0',
        '@aws-cdk/region-info': '0.27.0',
        '@aws-cdk/aws-kms': '0.27.0',
        '@aws-cdk/aws-s3-notifications': '0.27.0',
        '@aws-cdk/aws-codepipeline-api': '0.27.0',
        'jsii-runtime': 'node.js/v8.12.0' } },
  stacks: 
   [ { name: 'TestappStack',
       environment: [Object],
       template: [Object],
       metadata: [Object] } ] }
Removing outdir D:\xxxxxxxxxxxxxx\AppData\Local\Temp\cdkYL2v9X
The stack TestappStack already includes a CDKMetadata resource
Stack name not specified, so defaulting to all available stacks: TestappStack
Reading existing template for stack TestappStack.
Need to perform AWS calls for account unknown-account, but no credentials found. Tried: default credentials.
Error: Need to perform AWS calls for account unknown-account, but no credentials found. Tried: default credentials.
    at CredentialsCache.getCredentials (D:\xxxxxxxxxxxxxx\AppData\Roaming\npm\node_modules\aws-cdk\lib\api\util\sdk.ts:209:11)
    at <anonymous>

[Sparkboxx]

CDK not using the --profile setting

Is it expected behaviour that when a profile is configured in cdk.json that cdk uses your [default] credential profile if you don't give it an explicit --profile ? Or should it be safe to assume that if the profile is set in the cdk.json that when running a cdk command it uses the configured profile?

The story
I forgot to include the --profile myProfile a bunch of times while creating my app and ended up creating infrastructure my [default] profile account. This of course is user error, but I think an error other people might make too.

In order to avoid the problem I now setup an empty [default] profile, so that if I forget to include --profile myProfile I get an error. (Which is probably a good thing for me to do anyway working with multiple profiles)

CDK is configured with:

{
  "app": "node bin/app.js",
  "profile": "myProfile"
}