[Feature Request] Amplify CLI support AWS SSO

[v1pz3n]

Describe the bug

$ amplify env pull
⠦ Fetching updates to backend environment: dev from the cloud.(node:10308) UnhandledPromiseRejectionWarning: Error: connect EHOSTUNREACH 169.254.169.254:80
    at TCPConnectWrap.afterConnect [as oncomplete] (net.js:1141:16)
(Use `node --trace-warnings ...` to show where the warning was created)
(node:10308) UnhandledPromiseRejectionWarning: Unhandled promise rejection. This error originated either by throwing inside of an async function without a catch block, or by rejecting a promise which was not handled with .catch(). To terminate the node process on unhandled promise rejection, use the CLI flag `--unhandled-rejections=strict` (see https://nodejs.org/api/cli.html#cli_unhandled_rejections_mode). (rejection id: 1)
(node:10308) [DEP0018] DeprecationWarning: Unhandled promise rejections are deprecated. In the future, promise rejections that are not handled will terminate the Node.js process with a non-zero exit code.
⠋ Fetching updates to backend environment: dev from the cloud.

Amplify CLI Version
4.21.1

To Reproduce

1. aws sso login --profile dev
2. amplify pull or amplify env pull

Expected behavior
Update my local development environment

Desktop

• OS: Linux Mint 19.3
• Node Version. v14.3.0

[ahansson89]

I have a problem adding a new env with the Amplify CLI that uses a SSO profile. Getting

init failed
Error: connect ETIMEDOUT 169.254.169.254:80
    at TCPConnectWrap.afterConnect [as oncomplete] (net.js:1141:16) {
  message: 'Missing credentials in config, if using AWS_CONFIG_FILE, set AWS_SDK_LOAD_CONFIG=1',
  errno: 'ETIMEDOUT',
  code: 'CredentialsError',
  syscall: 'connect',
  address: '169.254.169.254',
  port: 80,
  time: 2020-06-08T05:08:14.592Z,
  originalError: {
    message: 'Could not load credentials from any providers',
    errno: 'ETIMEDOUT',
    code: 'CredentialsError',
    syscall: 'connect',
    address: '169.254.169.254',
    port: 80,
    time: 2020-06-08T05:08:14.592Z,
    originalError: {
      message: 'EC2 Metadata roleName request returned error',
      errno: 'ETIMEDOUT',
      code: 'ETIMEDOUT',
      syscall: 'connect',
      address: '169.254.169.254',
      port: 80,
      time: 2020-06-08T05:08:14.592Z,
      originalError: [Object]
    }
  }
}

[v1pz3n]

I tried another way but I also had problems.

You must delete the "amplify" directory of your project

$ aws sso login --profile amplify

Attempting to automatically open the SSO authorization page in your default browser.
If the browser does not open or you wish to use a different device to authorize this request, open the following URL:

https://device.sso.us-east-1.amazonaws.com/

Then enter the code:

XXXX-XXXX
Successully logged into Start URL: https://amplify.awsapps.com/start

$ amplify pull

For more information on AWS Profiles, see:
https://docs.aws.amazon.com/cli/latest/userguide/cli-multiple-profiles.html

? Do you want to use an AWS profile? Yes
? Please choose the profile you want to use amplify

Error: connect EHOSTUNREACH 169.254.169.254:80
    at TCPConnectWrap.afterConnect [as oncomplete] (net.js:1141:16) {
  message: 'Missing credentials in config, if using AWS_CONFIG_FILE, set AWS_SDK_LOAD_CONFIG=1',
  errno: -113,
  code: 'CredentialsError',
  syscall: 'connect',
  address: '169.254.169.254',
  port: 80,
  time: 2020-06-13T22:09:10.614Z,
  originalError: {
    message: 'Could not load credentials from any providers',
    errno: -113,
    code: 'CredentialsError',
    syscall: 'connect',
    address: '169.254.169.254',
    port: 80,
    time: 2020-06-13T22:09:10.614Z,
    originalError: {
      message: 'EC2 Metadata roleName request returned error',
      errno: -113,
      code: 'EHOSTUNREACH',
      syscall: 'connect',
      address: '169.254.169.254',
      port: 80,
      time: 2020-06-13T22:09:10.614Z,
      originalError: [Object]
    }
  }
}

[vgoetz]

Hi folks,

we also face a similar problem with slightly different error messages.
I've tried to describe it here also for the 'amplify init' command:

Issue when AWS Profile unable to run amplify init

[benkehoe]

You may be able to use aws-sso-credential-process with AWS_SDK_LOAD_CONFIG=1 set to enable AWS SSO credentials to be used.

If that doesn't work, there is a workaround, developed for the CDK (which has the same problem): aws/aws-cdk#5455 (comment)

[nishitjain13]

The aws2-wrap method referenced by @benkehoe is working absolutely fine for CDK. However, the amplify issue isn't getting resolved by it. Is there some other way that anyone has been able to get the amplify to work with sso credentials since the time this issue was first created?

[MFranca]

Hey, folks, let me know if this helps, since I was facing a very similar problem and (I think) I "fixed" it:
Setup

• Multiple AWS Accounts in AWS Organization with AWS Single Sign-On enabled for those accounts;
• Amplify with Angular (10) SPA - using basically (import) auth and (add) hosting;
  Issue: multiple profiles not working or amplify ends up publishing in the wrong (default) account.

$> amplify publish -c
× There was an error pulling the backend environment dev.
An error occurred during the push operation: The provided token has expired.

Fixing:

1. Run $> aws configure sso (for each AWS Account/profile) ==> this will update (only) the ~/.aws/config (Linux & Mac) or %USERPROFILE%.aws\config (Windows) file;
2. Copy the information from the SSO User Portal URL (repeat this step when the token expires) - command line or programmatic access (Option 2: Add a profile to your AWS credentials file) ==> user portal is something like 'https://xyz.awsapps.com/start#/'
3. Edit the ~/.aws/credentials (Linux & Mac) or %USERPROFILE%.aws/credentials (Windows) and paste the information from add cancel to delete and minor readme/help text changes #2. Save;
4. Run the command again: success.

[benkehoe]

@nishitjain13 Did you try the credential_process method using aws-sso-util instead of aws2-wrap? I have updated the documentation for it here.

Additionally, aws-export-credentials supports AWS SSO and allows you to inject environment variables with your credentials.