config: accept login_session profiles as an assume role source_profile - #3447
Open
alext wants to merge 1 commit into
Open
config: accept login_session profiles as an assume role source_profile#3447alext wants to merge 1 commit into
alext wants to merge 1 commit into
Conversation
A profile that sources its credentials from `aws login` (login_session) was
rejected when used as the source_profile of an assume-role profile, with config
loading failing as:
failed to load assume role <role-arn>, of profile <source>, <nil>
aws login support (aws#3230) wired login_session in as a direct credential provider
but did not update SharedConfig.hasCredentials(), which gates whether a linked
source profile supplies credentials. The source profile was therefore treated as
having no credentials and the assume-role chain failed to load. The AWS CLI and
botocore resolve the same configuration successfully.
Add a login_session case to hasCredentials(), alongside the existing
credential_process, web_identity_token_file and SSO cases.
wty-Bryant
reviewed
Jun 12, 2026
Madrigal
approved these changes
Jun 17, 2026
Author
|
Hi, what's required before this can be merged? Just want to make sure you're not waiting on me for anything. Thanks. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Fixes #3446
A profile using
login_session(aws login credentials) cannot be used as thesource_profileof an assume-role profile.config.LoadDefaultConfigfails with:aws loginsupport (#3230) addedlogin_sessionas a direct credential provider, butSharedConfig.hasCredentials()- which validates that a linked source profile actually supplies credentials - wasn't updated to recognise it. As a result a login-session source profile is treated as having no credentials and the assume-role chain fails to load. The AWS CLI / botocore resolve the same configuration successfully.A single profile combining
login_session+role_arn(nosource_profile) already works, because that path doesn't go through the source-profile validation; only thesource_profileform is affected.Fix
Fix this by including a check for
c.LoginSessioninhasCredentials()to add to the checks for the various other credential sources.