Skip to content
This repository has been archived by the owner on Sep 18, 2023. It is now read-only.

can't get a token when specifying a role on CLI #155

Closed
gdestuynder opened this issue Dec 5, 2019 · 1 comment
Closed

can't get a token when specifying a role on CLI #155

gdestuynder opened this issue Dec 5, 2019 · 1 comment
Labels
Type: bug Something isn't working

Comments

@gdestuynder
Copy link
Contributor

  1. call maws with a -r parameter while your STS token is expired: maws -r arn:aws:iam::320464205386:role/MAWS-Admin -o awscli

  2. Get an error / no web window open / maws is stuck until ^C

Error:

1 kang@xps13 ~ % maws -r arn:aws:iam::320464205386:role/MAWS-Admin -o awscli                                                    :(
ERROR:mozilla_aws_cli.sts_conn:AWS STS Call failed 400 : <ErrorResponse xmlns="https://sts.amazonaws.com/doc/2011-06-15/">
  <Error>
    <Type>Sender</Type>
    <Code>ExpiredTokenException</Code>
    <Message>Token too old: 153938</Message>
  </Error>
  <RequestId>cdebddb1-1779-11ea-9b4b-f55ed4088ab3</RequestId>
</ErrorResponse>

ERROR:mozilla_aws_cli.sts_conn:AWS STS Call failed 400 : <ErrorResponse xmlns="https://sts.amazonaws.com/doc/2011-06-15/">
  <Error>
    <Type>Sender</Type>
    <Code>ExpiredTokenException</Code>
    <Message>Token too old: 153939</Message>
  </Error>
  <RequestId>ce9abb7f-1779-11ea-9a9e-7fd145c5b7e6</RequestId>
</ErrorResponse>

ERROR:mozilla_aws_cli.login:AWS STS Call failed when attempting to assume role arn:aws:iam::320464205386:role/MAWS-Admin with amr ['', 'mozilliansorg_mozilla-iam-aws-access', 'team_opsec'] iss https://auth.mozilla.auth0.com/ and aud N7lULzWtfVUDGymwDs0yDEq6ZcwmFazj
ERROR:mozilla_aws_cli.login:Unable to assume role arn:aws:iam::320464205386:role/MAWS-Admin. Please select a different role.
^C
Aborted!

Expected results:
Web page open to log the user back in, or the id_token is re-used to issue new STS token.

Work-around:
Removing the -r parameter for this call

@gdestuynder gdestuynder added the Type: bug Something isn't working label Dec 5, 2019
@gene1wood
Copy link
Contributor

This is fixed in #150 but I've not deployed an updated Pypi release yet. I'll do so in the next couple days. For now, feel free to just delete the idtoken in your cache

Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Labels
Type: bug Something isn't working
Projects
None yet
Development

No branches or pull requests

2 participants