Bug: SSO Authentication stopped working

[driverpt]

Description:

Since installing sam 1.60.0, we notice that the Session is expired even though the Credentials are not.

Steps to reproduce:

• Login into SSO aws configure sso --profile default
• Add SSO Credentials to $HOME/.aws/config

Observed result:

sam package --output-template-file packaged.yaml --s3-bucket <Redacted>
Error: Unable to upload artifact <Redacted> referenced by Location parameter of <Redacted> resource.
Unable to upload artifact <Redacted> referenced by CodeUri parameter of <Redacted> resource.
The SSO session associated with this profile has expired or is otherwise invalid. To refresh this SSO session run aws sso login with the corresponding profile.
make: *** [package] Error 1

~/.aws/sso/cache/<redacted>.json contents:

{
  "startUrl": "<Redacted>",
  "region": "eu-west-1",
  "accessToken": <Redacted>",
  "expiresAt": "2022-10-14T17:12:19Z",
  "clientId": "<Redacted>",
  "clientSecret": "<Redacted>",
  "registrationExpiresAt": "2023-01-12T09:12:11Z"
}

By performing a simple command, like aws s3 ls everything is shown correctly.

This happens around 20/30 minutes after SSO CLI Login

Expected result:

sam package to work

Additional environment details (Ex: Windows, Mac, Amazon Linux etc)

1. OS: Mac OSX
2. sam --version: 1.60.0
3. AWS region: eu-west-1

[sriram-mv]

is there a previous version of sam that works for you? There do not seem to be any specific changes that went out for package in 1.60.0

[driverpt]

@sriram-mv , how do i install old version of sam using homebrew? I've tried brew install aws-sam-cli@1.59.0 but doesn't work

[sriram-mv]

Unfortunately I do think that we support that functionality with brew yet, you would have to use pip for that. (for a particular version)

However, I dug deeper and I am not to reproduce this. I created my own profile with sso and sam package worked just fine.

my command looks like below

sam package --profile mysso --s3-bucket <> --output-template-file packaged.yaml --force-upload

[tigrang]

I can repro when using sso_session key under profile. Running sso configure produced a ~/.aws/config file that looks like

[profile myprofile]
sso_session = mysession
sso_account_id  = xxxxx
sso_role_name = xxxxx
region = xxxx
output = json

[sso-session mysession]
sso_start_url = xxxx
sso_region = xxx
sso_registration_scopes = xxxx

I modified it to be the following which does work

[profile myprofile]
#sso_session = mysession <- commented out
sso_account_id  = xxxxx
sso_role_name = xxxxx
region = xxxx
output = json
sso_start_url = xxxx
sso_region = xxx
sso_registration_scopes = xxxx

aws-cli/2.9.2 asks for session name on configure. Looks like the format changed in new version.

[piurafunk]

I was encountering this on Sam 1.67.0, so I checked for updates, and updated to 1.78.0. It seems to have been resolved somewhere between 1.67.0 and 1.78.0, because it's working for me now. Using aws version aws-cli/2.11.6

[aviagarwal1212]

Hey all! I am still running into this issue. I am on sam 1.79.0. When I do sam local invoke, I get:

Error: Error when retrieving token from sso: Token has expired and refresh failed

I am on aws 2.11.13. I tried this with sam installed from both homebrew and pip.

Reconfiguring aws-cli (even though aws s3 ls worked fine) fixed it.