Root login fails: "Your authentication information is incorrect"

[iainelder]

I'm evaluating awsapilib to see whether it can help me automate the building of a landing zone.

I have root user credentials for an AWS account that I just created today.

I know the credentials are valid because I used them to log into the console and retrieve the account ID.

I try to do the same using the AccountManager class.

from awsapilib import AccountManager

email="..."
password="..."
region="eu-west-1"
am = AccountManager(email, password, region)

print(am.account_id)

I expect this to print an account ID like 111111111111.

Instead it prints a traceback and an error about invalidate credentials.

Traceback (most recent call last):
  File "<stdin>", line 1, in <module>
  File "/home/isme/.cache/pypoetry/virtualenvs/control-tower-RVRvYoiX-py3.8/lib/python3.8/site-packages/awsapilib/console/console.py", line 765, in account_id
    session = self._get_billing_session(self.email,
  File "/home/isme/.cache/pypoetry/virtualenvs/control-tower-RVRvYoiX-py3.8/lib/python3.8/site-packages/awsapilib/console/console.py", line 559, in _get_billing_session
    redirect_url = self._get_root_console_redirect(email, password, session, mfa_serial=mfa_serial)
  File "/home/isme/.cache/pypoetry/virtualenvs/control-tower-RVRvYoiX-py3.8/lib/python3.8/site-packages/awsapilib/console/console.py", line 552, in _get_root_console_redirect
    raise InvalidAuthentication(f'Unable to authenticate, response received was: {response.text} '
awsapilib.console.consoleexceptions.InvalidAuthentication: Unable to authenticate, response received was: {"state":"FAIL","properties":{"Message":"Your authentication information is incorrect. Please try again.","Title":"Authentication failed"}} with status code: 200

[iainelder]

I read similar issues #48 and #43 but didn't see anything that might solve my problem.

[costastf]

Hi @iainelder , thank you very much for reporting! I am sorry i did not respond earlier, was away on trainings on site. Next week I will be focusing on going through the backlog of issues and see if I can tackle them. Not sure if you are aware about this but if you you are trying to automate the creation of a landing zone, shall I suggest to have a look at https://superwerker.cloud/? I will probably ping you for more details on your issue next week when I work on it.

[iainelder]

Yes, Superwerker is on my list of things to try!

awsapilib is also interesting because it promises to automate actions without a public API. I don't know whether Superwerker also handles that.

[costastf]

Superwerker actually uses awsapilib under the hood for some actions, like setting up control tower and setting up the billing. I thing a mix and match approach would work best, where you would use superwerker and get a lot of stuff and maybe have another pass to customise if you want some stuff differently. But honestly the guys behind superwerker have done so much stuff that it does not make sense to try to reinvent that. ❤️

…

On Wed, May 31, 2023 at 11:52 AM Iain Samuel McLean Elder < ***@***.***> wrote: Yes, Superwerker is on my list of things to try! awsapilib is also interesting because it promises to automate actions without a public API. I don't know whether Superwerker also handles that. — Reply to this email directly, view it on GitHub <#49 (comment)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/ABDMK23QBYVKE5OUZNS2KWDXI4IEHANCNFSM6AAAAAAYGWQLOM> . You are receiving this because you commented.Message ID: ***@***.***>

[iainelder]

Superwerker actually uses awsapilib under the hood for some actions, like setting up control tower and setting up the billing.

Thanks for sharing. It sounds then like Superwerker is a good place to start.

I'll leave this issue open anyway so that you may investigate and decide what to do with it. Let me know if you need more details from me.

[costastf]

Will do next week when i work on this. Good luck with Superwerker!

[iainelder]

It seems that awsapilib is failing to detect the captcha response from the console login flow.

---

In my browser, I would do this:

• Open console home in my browser (https://us-east-1.console.aws.amazon.com/console/home)
• Select "Root user" sign in type
• Paste my root user email address into the text field
• Click the Next button

The console presents me with a "Security check" page that displays the text "Type the chatacters seen in the image below" and a captcha image.

---

When I enable debug messages in awsapilib, it says it doesn't detect a captcha.

In my terminal:

• Enter a virtualenv with awsapilib installed

• Save this to debug_account_manager.py.

  import logging
  from awsapilib import AccountManager
  
  logging.basicConfig()
  logging.getLogger("authentication.AccountManager").setLevel("DEBUG")
  
  with open("/tmp/pass") as f:
      email, password = f.read().split(",")
  region="us-east-1"
  am = AccountManager(email, password, region)
  
  print(am.account_id)

• Save credentials in email,password format in /tmp/pass.

• Execute the script to see the debug message before the failure.

  python debug_account_manager.py

awsapilib prints DEBUG:authentication.AccountManager:No Captcha information found.. The complete output follows.

DEBUG:authentication.AccountManager:Trying to get url: https://us-east-1.console.aws.amazon.com/console/home with parameters :{'hashArgs': '#a', 'skipRegion': 'true', 'region': 'us-east-1'}
DEBUG:authentication.AccountManager:No Captcha information found.
Traceback (most recent call last):
  File "debug_account_manager.py", line 12, in <module>
    print(am.account_id)
  File "/home/isme/.cache/pypoetry/virtualenvs/landing-zone-accelerator-8fwM1A1d-py3.8/lib/python3.8/site-packages/awsapilib/console/console.py", line 765, in account_id
    session = self._get_billing_session(self.email,
  File "/home/isme/.cache/pypoetry/virtualenvs/landing-zone-accelerator-8fwM1A1d-py3.8/lib/python3.8/site-packages/awsapilib/console/console.py", line 559, in _get_billing_session
    redirect_url = self._get_root_console_redirect(email, password, session, mfa_serial=mfa_serial)
  File "/home/isme/.cache/pypoetry/virtualenvs/landing-zone-accelerator-8fwM1A1d-py3.8/lib/python3.8/site-packages/awsapilib/console/console.py", line 552, in _get_root_console_redirect
    raise InvalidAuthentication(f'Unable to authenticate, response received was: {response.text} '
awsapilib.console.consoleexceptions.InvalidAuthentication: Unable to authenticate, response received was: {"state":"FAIL","properties":{"Message":"Your authentication information is incorrect. Please try again.","Title":"Authentication failed"}} with status code: 200

[costastf]

Hi, i am working on this issue since yesterday. The problem is that aws requires the sending of a metadata1 argument that holds all kinds of fingerprinting metrics to accept the submission of the form. If that is not sent, or is not correct (or correct looking) the flow does not really work. I have made it all the way to logging in so I have a POC. I hope to be able to fix this and the other stuff during this week. Currently have been distracted with something else but will get back to it shortly.

[iainelder]

Thank you, @costastf. I appreciate the work you are doing on this. Let me know if I can help in any way.

[costastf]

Your feedback is help enough :)

[iainelder]

I just discovered the metadata1 hidden input parameter today in my browser's DOM inspector.

I searched on Google for metadata1 and "ECdITeCs:" to find some possible solutions to processing it.

• https://github.com/saucesteals/metadata1
• https://www.jeffmao.me/bot-protection/2021/02/16/21-decrypting-amazon-metadata.html
• https://stackoverflow.com/questions/67139708/how-can-i-properly-mimic-this-encryption-method-to-produce-the-proper-value-for
• https://audible.readthedocs.io/en/latest/_modules/audible/metadata.html

[costastf]

Thanks! I have already solved this by seeing some of these myself. I will hopefully next week be able to wrap everything up. Random metadata1 along with lsubid are being created just fine and authentication flow continues. I need to match all the headers and cookies and clean up. It is just quite tedious and confusing work because there are a lot of handshakes and many exchanges, cookie invalidation and every service in AWS has it's own flow. Thanks for thinking along though ❤️ @iainelder

[iainelder]

Happy to help out!

The creation of a stand-alone AWS account includes an identity verification step. It appears to use the same captcha. I've been working on a way to automate the account creation. That's how I discovered the parameter now.

My approach is to use Selenium and Firefox to fill in all the forms. In that way I hope the browser automatically submits the correct metadata1 value. (I say "hope" because the UI apparently changed again to break my automation!)

I'm interested to see how your approach works. It seems that one way or another, some reverse engineering is required, either of the fingerprinting or of the UI elements.

[costastf]

Hi @iainelder , I have pushed a WIP branch of mostly working code (in not great shape, it needs a lot of refactoring and many things are not aligned throughout the code base, but it proves the case) https://github.com/schubergphilis/awsapilib/tree/fix-root-login. On that branch, under the console package there is a metadata module that has all the required code for the authentication to work. I will continue on this and clean it up and make it more robust, but I thought I'd share the progress in case it helps you with your efforts.