ruimarinho / gsts

Obtain and store AWS STS credentials to interact with Amazon services by authenticating via G Suite SAML.
MIT License
212 stars 37 forks source link

No credentials are written to ~/.aws/credentials as of v5.0.0 #91

Closed cvernooy23 closed 11 months ago

cvernooy23 commented 1 year ago

I have been using this for a while now, but as of upgrading to v5.0.0 the credentials are not written to ~/.aws/credentials. The last credentials I have in the file are from March 14, 2023, no matter how many times I run it nothing is written.

output:

✔ Login successful!

I've double checked and confirmed my user is the owner of that file and has read write permissions. Are there any logs I can check? I have tried deleting all of the information in the file and deleting all but the profile "default" to no avail.

amrutcatsalt commented 1 year ago

By default credentials are read and writtien to Loaded credentials from "$HOME/Library/Caches/gsts/credentials" for profile "default".

Tried to set --cache-dir but did not help. $ gsts --version
5.0.0

reijmer commented 1 year ago

I am experiencing the same issue on Mac

jontg commented 11 months ago

the 5.x line of gsts changed things significantly - see the notes in https://github.com/ruimarinho/gsts/pull/82 and specifically

image

The recommended path moving forward is

image

that is, remove the entry for your credentials from ~/.aws/credentials, and adda new line in~/.aws/config` as per ☝️.

You may also find frustration working with multiple profiles. Ping @ruimarinho and gently ask them to review/merge https://github.com/ruimarinho/gsts/pull/90 (or consider migrating to a fork that has this issue addressed).

ruimarinho commented 11 months ago

As @jontg kindly explained, this is expected behaviour on v5 (it's a feature, not a bug). Credentials aren't stored as part of this new architecture, ensuring more security. I will try to address #90 because my reading is that there is a bug handling multiple profiles.

The goal is to make gsts almost invisible, where you don't need to interact much with the tool beyond the original Google account login.