Comments (4)
Hey @adamdmharvey,
I did some digging and I ended validating the command by using ${PIPESTATUS[0]}
. It'll cause the command to fail with the appropriate errors and exit codes from AWS
Best,
Brian
from aws-cli-orb.
Hey @adamdmharvey,
Thanks for letting us know. I think this is a bug with the AWS CLI
specifically.
In the script below, I am purposely setting PARAM_ROLE_SESSION_NAME
to a blank space so that the command fails. I am also echoing $?
to check the status code of the command.
As you can see below, the script obviously fails judging from the error message, yet the exit code is still 0
.
The only thing I can think of is adding our own validation checking to see if the PARAM_ROLE_SESSION_NAME
is empty along with the AWS_SESSION_TOKEN
. The thought is if assuming the role is successful, a session token is generated. If there is no session token, then the command failed.
My question is in your specific case, is a session token generated? If there is, can you think of any other way to handle the error?
Let me know and thanks for catching this!
Best,
Brian
from aws-cli-orb.
Thanks, @brivu . My speculation was it was not an error with the CLI, and unrelated to the session name, but with the wrapping of the CLI call into the read statement, such that any error in the CLI would effectively be "trapped" by the outer command, and even if the result was invalid environment variables, we'd get an exit 0.
Just running a raw assume role which fails, it definitely returns an exit code 254:
$ aws sts assume-role-with-web-identity \
--role-arn 'arn:aws:iam::1234567890:role/fake-role' \
--role-session-name 'my-session' \
--web-identity-token 'fake-token' \
--duration-seconds 3600 \
--query 'Credentials.[AccessKeyId,SecretAccessKey,SessionToken]' \
--output text
An error occurred (InvalidIdentityToken) when calling the AssumeRoleWithWebIdentity operation: The ID Token provided is not a valid JWT. (You may see this error if you sent an Access Token)
$ echo $?
254
Excited about your change; thanks for the quick turnaround. Happy to give it a shot on my end!!
from aws-cli-orb.
My team and I just tested this orb fix and can confirm a user who is not authorized to assume the role in AWS, when triggering the pipeline now successfully gets an error message on this step. So for now, the fix addresses my issue; thanks Brian!
from aws-cli-orb.
Related Issues (20)
- `install` on older windows images fails when `override_installed: true` HOT 6
- 'role_arn' IS a required argument when calling 'aws-cli/setup' HOT 2
- circleci/[email protected] fails on aws-cli/setup - Error relocating /usr/bin/curl (alpine)
- Generate shortlived AWS Keys using CircleCI OIDC token fails
- Grep statement in install.sh (Windows) can cause wrong path to be added HOT 1
- 'disable_aws_pager' argument ignored if AWS CLI is already installed
- Enhance Installation Flow for Existing CLI Versions
- multiple calls to setup don't use newest role
- Broken AWS Credentials after #164 (4.1.2) HOT 8
- The documentation on aws sts assume-role is incorrect / not working in real world scenarios HOT 2
- Incorrect Version Check in Installation Script (install.sh) when using 'latest'
- Extra hyphen at the end of role_session_name HOT 1
- upgrade glibc from 2.34-r0 to 2.35-r1 to resolve nsswitch cannot be overwrriten issue
- /tmp/default.keys: No such file or directory HOT 3
- OICD AWS Provider - Old AWS orb version not consistent with > 4.0 version causing issues with AWS Credentials configuration HOT 1
- `setup` command fails with OIDC role while `AWS_ACCESS_KEY_ID` and `AWS_SECRET_ACCESS_KEY` are set in the environment HOT 5
- Unable to use a dynamic `role_arn` with `assume_role_with_web_identity` command HOT 1
- Permission Denied for $BASH_ENV in v4.1.3
- setup not creating fully up to date credentials file
- aws-cli/install step fails using [email protected] on xcode 15.4.0 HOT 2
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from aws-cli-orb.