Can't use a profile that used aws login for temporary credentials

[amcsi]

Describe the bug

I would like to be able to use a profile configured automatically by the aws login CLI command, but I'm not able to, because the SDK seems to demand that whichever profile I use (or whichever profile is referenced as source_profile) must have aws_access_key_id and aws_secret_access_key.
And by the way running the AWS CLI with that same profile works, and I'm able to run this command fine, successfully: aws rds describe-db-instances --profile project-monitor.

AWS PHP SDK version: 3.384.7

Regression Issue

• Select this option if this issue appears to be a regression.

Expected Behavior

It's expected to work and list the files. Just as if I had source_profile = default within [profile aszeremi-local]

php artisan tinker

Psy Shell v0.12.9 (PHP 8.4.21 — cli) by Justin Hileman
> Storage::drive('s3')->files()

[
    "SANDBOX-0283344D-8126-4530-A518-4F04378118AA.json",
    "SANDBOX-145880F2-B469-4D9A-A086-AE5AD126DECB.json",
]

Current Behavior

Running

php artisan tinker

This happens when I try to list the files:

Psy Shell v0.12.9 (PHP 8.4.21 — cli) by Justin Hileman
> Storage::drive('s3')->files()

   League\Flysystem\UnableToListContents  Unable to list contents for '', shallow listing

Reason: No credentials present in INI profile 'aszeremi-local' (/home/attila/.aws/credentials)

Reproduction Steps

This is what's in my ~/.aws/config:

[default]
aws_access_key_id = ...
aws_secret_access_key = ...

This is what was in my ~/.aws/config:

[profile project-monitor]
role_arn = arn:aws:iam::123456789012:role/project-monitor
source_profile = default
region = us-east-1

This is in my Laravel project's .env:

AWS_ACCESS_KEY_ID=
AWS_SECRET_ACCESS_KEY=
AWS_SDK_LOAD_NONDEFAULT_CONFIG=1
AWS_PROFILE=project-monitor
AWS_DEFAULT_REGION=us-east-1
AWS_REGION=us-east-1

With this I am able to perform the AWS S3 task that I want.

But now I wanted to move away from using long-lived credentials locally...
So after running aws login --profile aszeremi-local and logging in, this got appended to ~/.aws/config:

[profile aszeremi-local]
login_session = arn:aws:iam::123456789012:user/aszeremi-local
region = us-east-1

So now I changed my project-monitor profile to use the new aszeremi-local profile as the source, so now this is my ~/.aws/config:

[profile project-monitor]
role_arn = arn:aws:iam::123456789012:role/project-monitor
source_profile = aszeremi-local # <- this is the change I made
region = us-east-1
[profile aszeremi-local]
login_session = arn:aws:iam::123456789012:user/aszeremi-local
region = us-east-1

Possible Solution

No response

Additional Information/Context

No response

SDK version used

3.384.7

Environment details (Version of PHP (php -v)? OS name and version, etc.)

PHP 8.4.21, Ubuntu 24.04

[stobrien89]

Thanks for the report. A couple of things to sort out before this can be classified:

source_profile is only consulted when a profile has role_arn and the SDK is performing role assumption via STS. It is not part of the login-credential resolution path. A profile that only has login_session is resolved by CredentialProvider::login(), which ignores source_profile entirely.

The error you're seeing comes from AWS_PROFILE=project-monitor. That profile has role_arn, so the SDK enters the role-assumption path and tries to load credentials from the source_profile (aszeremi-local) using the INI provider, which only looks for aws_access_key_id / aws_secret_access_key. It does not try login_session for the source profile.

After the switch to aws login, do you still need to assume the project-monitor role? Or is the role profile leftover from your previous setup and you actually want the credentials from aszeremi-local directly?

If you only need aszeremi-local, set AWS_PROFILE=aszeremi-local and remove the project-monitor block. CredentialProvider::login() is in the default chain and will resolve it. You could also explicitly set
'credentials' => CredentialProvider::memoize(CredentialProvider::login(<login_profile>)) in your client config to bypass the default credential provider chain entirely. More info here: https://docs.aws.amazon.com/sdk-for-php/v3/developer-guide/login-provider.html

[stobrien89]

Following up on this: re-checking the AWS Login Credentials Provider specification, login_session is defined as a key on the resolved profile in the default credentials chain. It is not part of the role-assumption / source_profile resolution path, and the spec explicitly designates credential_process as the interop mechanism for combining login credentials with role assumption (the AWS CLI documents this publicly under "Sharing Login credentials as process credentials").

The supported configuration for your scenario today is:

[profile aszeremi-local]
login_session = arn:aws:iam::123456789012:user/aszeremi-local
region = us-east-1

[profile aszeremi-local-process]
credential_process = aws configure export-credentials --profile aszeremi-local --format process
region = us-east-1

[profile project-monitor]
role_arn = arn:aws:iam::123456789012:role/project-monitor
source_profile = aszeremi-local-process
region = us-east-1

With AWS_PROFILE=project-monitor, the SDK resolves the role profile, follows source_profile to aszeremi-local-process, invokes aws configure export-credentials to get login-backed credentials, and uses those to call AssumeRole. (Apologies for my earlier suggestion to set AWS_PROFILE=aszeremi-local directly. That gives you the human identity's credentials rather than the assumed role, so it's not equivalent to your previous source_profile = default setup.)

If you'd like to see direct login_session (or sso_session) support as a source_profile target across SDKs, that's a cross-SDK contract change rather than a PHP-only patch and would best be raised as a feature request describing the use case so it can be evaluated against the relevant specs.

[amcsi]

@stobrien89 Regarding your first comment:

After the switch to aws login, do you still need to assume the project-monitor role? Or is the role profile leftover from your previous setup and you actually want the credentials from aszeremi-local directly?

I do still need to assume the role, because the aszeremi-local profile only has access to assume roles (e.g. the project-monitor role), and does not have the access to do things on its own. The purpose of the switch really is to take security a step further, so role assuming would stay, but long-lived credentials for local development would be changed to using login sessions instead.

Regarding your second comment:

The supported configuration for your scenario today is:

Unfortunately, I tried it, and that didn't work either. I tried to add this to ~/.aws/config:

[profile aszeremi-local-process]
credential_process = aws configure export-credentials --profile aszeremi-local --format process
region = us-east-1

...and then for [profile project-monitor] change source_profile = aszeremi-local to source_profile = aszeremi-local-process. The result was the exact same error, but pointing to a the new profile: Aws\Exception\CredentialsException: No credentials present in INI profile 'aszeremi-local-process' (/home/attila/.aws/credentials) in ....

Running aws rds describe-db-instances --profile project-monitor did continue to work though, which likely used the aszeremi-local-process profile, because of the configuration.

If you'd like to see direct login_session (or sso_session) support as a source_profile target across SDKs, that's a cross-SDK contract change rather than a PHP-only patch and would best be raised as a feature request describing the use case so it can be evaluated against the relevant specs.

I've tried the same with Python and boto3, and these were the results:

Using your PHP suggestion to use an aszeremi-local-process profile worked out of the box with boto3 and AWS_PROFILE=project-monitor set.

Trying to use the original plain aszeremi-local as a source profile (which worked out of the box for AWS CLI), I got this error: AWS SDK error: Missing Dependency: Using the login credential provider requires an additional dependency. You will need to pip install "botocore[crt]" before proceeding.

But then after installing that dependency, it worked even using aszeremi-local as the source_profile.
Here's the code: https://github.com/amcsi/boto3-test

So at least in Python's boto3 this is already supported.

Not sure about the JS library, which is also a big SDK.

But yeah, I would love direct login_session (or sso_session) support in the PHP SDK.