[cli] CDK_DEFAULT_ACCOUNT not set when using MFA and --profile specified

[unleashed-jamest]

It looks like #6510 has caused a regression when using profiles with MFA on the cli. It seems when --profile is specified and the profile contains an mfa_serial then --verbose shows a message saying Unable to determine the default AWS account after entering a valid MFA code. When synth runs the value of the CDK_DEFAULT_ACCOUNT environment variable is blank.

This is a breaking change for us. We were successfully using aws-mfa with profiles before 1.60.0 as a workaround to not having official mfa support. I have confirmed 1.59.0 does not have this issue. I couldn't quite get aws-mfa to work with 1.60.0 either to see if I could still work around this, so probably can't take this version until this is resolved.

Reproduction Steps

Set up a profile in ~/.aws/credentials

[cool-guy]
role_arn = arn:aws:iam::987654321987:role/cool-role
source_profile = default
region = ap-southeast-2
output = json
mfa_serial = arn:aws:iam::123456789123:mfa/cool.user

Set up a minimal stack and at the beginning of the program try to load the default account and error out if it's not present.

sealed class Program
{
    public static void Main(string[] args)
    {
        var app = new App();
        var accountId = System.Environment.GetEnvironmentVariable("CDK_DEFAULT_ACCOUNT");
        if(string.IsNullOrEmpty(accountId))
            throw new ArgumentNullException("CDK_DEFAULT_ACCOUNT");
        
        var region = System.Environment.GetEnvironmentVariable("CDK_DEFAULT_REGION");
        if(string.IsNullOrEmpty(accountId))
            throw new ArgumentNullException("CDK_DEFAULT_REGION");
        
        new MyCoolStack(app, "MyCoolStack", new MyCoolStackProps
        {
            Env = new Environment
            {
                Account = accountId,
                Region = region
            }
        });
        app.Synth();
    }
}

Run cdk synth --profile cool-guy

What did you expect to happen?

I expect given I'm invoking a cdk command with a --profile when I enter my MFA code it correctly sets the value of CDK_DEFAULT_ACCOUNT

What actually happened?

--verbose shows an error message Unable to determine the default AWS account and the value of the environment variable CDK_DEFAULT_ACCOUNT is empty when my cdk code is executing.

Environment

• cdk version:1.60.0
• node version: 10.15.0
• Windows 10
• C# 7.3 / netcoreapp3.1

---

This is 🐛 Bug Report

[OxfordGrid]

Hey guys, is there an update to this bug? As it stops me from using the latest versions.

[alexandervandekleutab]

I'm still encountering this issue.

[github-actions]

This issue has not received any attention in 1 year. If you want to keep this issue open, please leave a comment below and auto-close will be canceled.

[badmintoncryer]

Please try

set AWS_DEFAULT_PROFILE=profile_a
cdk deploy

instead of

cdk deploy --profile=profile_a