Follow source_profile in the AWS config, and improve the handling of role_arn + SSO configurations (#690)

* Respect source_profile in AWS config

* Add a test to confirm that an incomplete profile cascades

* Prevent capture of errors for unreadable credentials files

* Include the origin profile when evaluating a credential change that errors

* Update visibiliy of ProfileCredentialError

* Throw new CredentialProviderError.fileDoesNotExist

* Fix up formatting mistake

Author: nicksloan

Sources/SotoCore/Credential/ConfigFileCredentialProvider.swift

@@ -70,7 +70,11 @@ final class ConfigFileCredentialProvider: CredentialProviderSelector {
             profile: profile,
             threadPool: threadPool
         )
-        return try self.credentialProvider(from: sharedCredentials, context: context, endpoint: endpoint)
+        let provider = try self.credentialProvider(from: sharedCredentials, context: context, endpoint: endpoint)
+        // Tag any error surfaced from this provider with the originating profile, so a failure
+        // inside a credential chain (source profile, SSO source, STS AssumeRole, etc.) names
+        // the profile the caller actually asked to resolve.
+        return ProfileScopedCredentialProvider(inner: provider, profile: profile)
     }
 
     /// Generate credential provider based on shared credentials and profile configuration
@@ -104,3 +108,43 @@ final class ConfigFileCredentialProvider: CredentialProviderSelector {
         }
     }
 }
+
+/// Wraps a credential provider so any error it raises is reported in terms of the profile
+/// the caller asked to resolve. Without this, an error from a source profile, SSO source, or
+/// STS AssumeRole call does not mention the profile that initiated the lookup.
+struct ProfileScopedCredentialProvider: CredentialProvider {
+    let inner: CredentialProvider
+    let profile: String
+
+    var description: String { "\(inner) (profile: \(profile))" }
+
+    func getCredential(logger: Logger) async throws -> Credential {
+        do {
+            return try await self.inner.getCredential(logger: logger)
+        } catch {
+            throw ProfileCredentialError(profile: self.profile, underlying: error)
+        }
+    }
+
+    func shutdown() async throws {
+        try await self.inner.shutdown()
+    }
+}
+
+/// Error thrown when credential resolution for a profile fails. Preserves the underlying
+/// error so callers can still inspect the original cause.
+public struct ProfileCredentialError: Error, CustomStringConvertible {
+    /// The profile the caller asked to resolve.
+    public let profile: String
+    /// The error raised somewhere within the credential resolution for `profile`.
+    public let underlying: any Error
+
+    public init(profile: String, underlying: any Error) {
+        self.profile = profile
+        self.underlying = underlying
+    }
+
+    public var description: String {
+        "Failed to resolve credentials for profile '\(self.profile)': \(self.underlying)"
+    }
+}

Sources/SotoCore/Credential/ConfigFileLoader.swift

@@ -88,13 +88,16 @@ enum ConfigFileLoader {
     /// - missingSecretAccessKey: If the secret access key was not found
     public struct ConfigFileError: Error, Equatable {
         enum Internal: Equatable {
+            case fileDoesNotExist
             case invalidINIFile
             case missingProfile
             case missingAccessKeyId
             case missingSecretAccessKey
         }
         let value: Internal
 
+        /// Credentials or profile ini file does not exist
+        public static var fileDoesNotExist: Self { .init(value: .fileDoesNotExist) }
         /// Credentials or profile ini file failed to load
         public static var invalidINIFile: Self { .init(value: .invalidINIFile) }
         /// Cannot find profile in ini file
@@ -120,28 +123,39 @@ enum ConfigFileLoader {
         threadPool: NIOThreadPool = .singleton
     ) async throws -> SharedCredentials {
         let fileIO = NonBlockingFileIO(threadPool: threadPool)
-        let credentialsINIParser: INIParser
+        // Only treat "file does not exist" as a soft miss. Other failures (permission denied,
+        // I/O errors, malformed INI) propagate so the caller sees why credential lookup failed
+        // instead of silently falling through to the next provider.
+        let credentialsINIParser: INIParser?
         do {
-            // Load credentials file
-            credentialsINIParser = try await self.loadINIFile(
-                path: credentialsFilePath,
-                fileIO: fileIO
-            )
-        } catch {
-            // Throw `.noProvider` error if credential file cannot be loaded
-            throw CredentialProviderError.noProvider
+            credentialsINIParser = try await self.loadINIFile(path: credentialsFilePath, fileIO: fileIO)
+        } catch let error as ConfigFileError where error == ConfigFileError.fileDoesNotExist {
+            credentialsINIParser = nil
         }
         let configINIParser: INIParser?
         do {
-            // Load profile config file
-            configINIParser = try await self.loadINIFile(
-                path: configFilePath,
-                fileIO: fileIO
-            )
-        } catch {
+            configINIParser = try await self.loadINIFile(path: configFilePath, fileIO: fileIO)
+        } catch let error as ConfigFileError where error == ConfigFileError.fileDoesNotExist {
             configINIParser = nil
         }
-        return try self.parseSharedCredentials(from: credentialsINIParser, configINIParser: configINIParser, for: profile)
+
+        // If neither file is available there's nothing to resolve — fall through to the next
+        // provider in the chain, matching the historical contract for a missing credentials file.
+        if credentialsINIParser == nil && configINIParser == nil {
+            throw CredentialProviderError.noProvider
+        }
+
+        do {
+            return try self.parseSharedCredentials(
+                from: credentialsINIParser,
+                configINIParser: configINIParser,
+                for: profile
+            )
+        } catch let error as ConfigFileError where error == .missingProfile && credentialsINIParser == nil {
+            // The credentials file was unavailable and the config file didn't supply the profile
+            // either — preserve the "fall through to the next provider" behavior.
+            throw CredentialProviderError.noProvider
+        }
     }
 
     /// Load a file from disk without blocking the current thread
@@ -162,7 +176,13 @@ enum ConfigFileLoader {
     ///   - fileIO: non-blocking file IO
     /// - Returns: INIParser
     static func loadINIFile(path: String, fileIO: NonBlockingFileIO) async throws -> INIParser {
-        let buffer = try await loadFile(path: path, fileIO: fileIO)
+        let buffer: ByteBuffer
+        do {
+            buffer = try await loadFile(path: path, fileIO: fileIO)
+        } catch let error as IOError where error.errnoCode == ENOENT {
+            throw ConfigFileError.fileDoesNotExist
+        }
+
         let content = String(buffer: buffer)
         guard let parser = try? INIParser(content) else {
             throw ConfigFileError.invalidINIFile
@@ -184,34 +204,58 @@ enum ConfigFileLoader {
     ///   - profile: named profile to load (optional)
     /// - Returns: Parsed SharedCredentials
     static func parseSharedCredentials(
-        from credentialsINIParser: INIParser,
+        from credentialsINIParser: INIParser?,
         configINIParser: INIParser?,
         for profile: String
     ) throws -> SharedCredentials {
         let config = try configINIParser.flatMap { try self.parseProfileConfig(from: $0, for: profile) }
-        let credentials = try parseCredentials(from: credentialsINIParser, for: profile, sourceProfile: config?.sourceProfile)
+
+        // The profile may live only in the config file (typical for assume-role chains whose
+        // source is an SSO profile). Tolerate `.missingProfile` from `parseCredentials` when
+        // the config file already supplies a `role_arn`, and skip the call entirely when
+        // the credentials file is unavailable.
+        let credentials: ProfileCredentials?
+        if let credentialsINIParser {
+            do {
+                credentials = try parseCredentials(from: credentialsINIParser, for: profile, sourceProfile: config?.sourceProfile)
+            } catch let error as ConfigFileError where error == .missingProfile && config?.roleArn != nil {
+                credentials = nil
+            }
+        } else {
+            credentials = nil
+        }
 
         // If `role_arn` is defined, check for source profile or credential source
-        if let roleArn = credentials.roleArn ?? config?.roleArn {
-            let sessionName = credentials.roleSessionName ?? config?.roleSessionName ?? UUID().uuidString
+        if let roleArn = credentials?.roleArn ?? config?.roleArn {
+            let sessionName = credentials?.roleSessionName ?? config?.roleSessionName ?? UUID().uuidString
             let region = config?.region ?? .useast1
             // If `source_profile` is defined, temporary credentials must be loaded via STS AssumeRole operation
-            if let _ = credentials.sourceProfile ?? config?.sourceProfile {
-                guard let accessKey = credentials.accessKey else {
+            if let sourceProfileName = credentials?.sourceProfile ?? config?.sourceProfile {
+                // If the source profile is an SSO profile (per the config file), use SSO to obtain
+                // the source credentials instead of looking up static keys.
+                if let configINIParser, Self.isSSOProfile(in: configINIParser, profile: sourceProfileName) {
+                    return .assumeRole(
+                        roleArn: roleArn,
+                        sessionName: sessionName,
+                        region: region,
+                        sourceCredentialProvider: .sso(profileName: sourceProfileName)
+                    )
+                }
+                guard let accessKey = credentials?.accessKey else {
                     throw ConfigFileError.missingAccessKeyId
                 }
-                guard let secretAccessKey = credentials.secretAccessKey else {
+                guard let secretAccessKey = credentials?.secretAccessKey else {
                     throw ConfigFileError.missingSecretAccessKey
                 }
                 let provider: CredentialProviderFactory = .static(
                     accessKeyId: accessKey,
                     secretAccessKey: secretAccessKey,
-                    sessionToken: credentials.sessionToken
+                    sessionToken: credentials?.sessionToken
                 )
                 return .assumeRole(roleArn: roleArn, sessionName: sessionName, region: region, sourceCredentialProvider: provider)
             }
             // If `credental_source` is defined, temporary credentials must be loaded from source
-            else if let credentialSource = credentials.credentialSource ?? config?.credentialSource {
+            else if let credentialSource = credentials?.credentialSource ?? config?.credentialSource {
                 let provider: CredentialProviderFactory
                 switch credentialSource {
                 case .environment:
@@ -228,6 +272,9 @@ enum ConfigFileLoader {
         }
 
         // Return static credentials
+        guard let credentials else {
+            throw ConfigFileError.missingProfile
+        }
         guard let accessKey = credentials.accessKey else {
             throw ConfigFileError.missingAccessKeyId
         }
@@ -238,6 +285,14 @@ enum ConfigFileLoader {
         return .staticCredential(credential: credential)
     }
 
+    /// Returns true if the given profile's section in the AWS config file declares SSO
+    /// (either the modern `sso_session` reference or the legacy `sso_start_url` keys).
+    static func isSSOProfile(in configINIParser: INIParser, profile: String) -> Bool {
+        let sectionKey = profile == Self.defaultProfile ? profile : "profile \(profile)"
+        guard let section = configINIParser.sections[sectionKey] else { return false }
+        return section["sso_session"] != nil || section["sso_start_url"] != nil
+    }
+
     /// Parse profile configuraton from a file (passed in as byte-buffer), usually `~/.aws/config`
     ///
     /// - Parameters:

Tests/SotoCoreTests/Credential/ConfigFileCredentialProviderTests.swift

@@ -13,6 +13,7 @@
 //===----------------------------------------------------------------------===//
 
 import AsyncHTTPClient
+import Logging
 import NIOCore
 import NIOPosix
 import SotoTestUtils
@@ -79,6 +80,57 @@ class ConfigFileCredentialProviderTests: XCTestCase {
         try await httpClient.shutdown()
     }
 
+    func testProfileScopedProviderWrapsErrorWithProfileName() async throws {
+        // Direct unit test for the wrapper: any error from the inner provider must surface as
+        // a `ProfileCredentialError` whose description includes the profile name and whose
+        // `underlying` preserves the original error.
+        struct StubError: Error, Equatable {}
+        struct ThrowingProvider: CredentialProvider {
+            func getCredential(logger: Logger) async throws -> Credential { throw StubError() }
+        }
+        let wrapped = ProfileScopedCredentialProvider(inner: ThrowingProvider(), profile: "dev")
+
+        do {
+            _ = try await wrapped.getCredential(logger: TestEnvironment.logger)
+            XCTFail("Expected ProfileCredentialError")
+        } catch let error as ProfileCredentialError {
+            XCTAssertEqual(error.profile, "dev")
+            XCTAssertTrue(error.underlying is StubError)
+            XCTAssertTrue(error.description.contains("dev"), "Description should name the profile: \(error.description)")
+        } catch {
+            XCTFail("Expected ProfileCredentialError, got \(error)")
+        }
+    }
+
+    func testCredentialProviderTagsErrorsWithProfileFromFile() async throws {
+        // Integration check: loading via the file overload must produce a `ProfileScopedCredentialProvider`
+        // bound to the requested profile, so any failure from inside the chain surfaces with that profile.
+        let profile = "dev"
+        let credentialsFile = """
+            [\(profile)]
+            aws_access_key_id = AKIAIOSFODNN7EXAMPLE
+            aws_secret_access_key = wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY
+            """
+        let credentialsPath = "creds-\(UUID().uuidString)"
+        try credentialsFile.write(toFile: credentialsPath, atomically: true, encoding: .utf8)
+        defer { try? FileManager.default.removeItem(atPath: credentialsPath) }
+        let (context, httpClient) = self.makeContext()
+
+        let provider = try await ConfigFileCredentialProvider.credentialProvider(
+            from: credentialsPath,
+            configFilePath: "/dev/null",
+            for: profile,
+            context: context,
+            endpoint: nil
+        )
+
+        let scoped = try XCTUnwrap(provider as? ProfileScopedCredentialProvider)
+        XCTAssertEqual(scoped.profile, profile)
+
+        try await provider.shutdown()
+        try await httpClient.shutdown()
+    }
+
     // MARK: - Config File Credentials Provider
 
     func testConfigFileSuccess() async throws {
@@ -135,15 +187,22 @@ class ConfigFileCredentialProviderTests: XCTestCase {
     }
 
     func testConfigFileNotAvailable() async {
-        let filename = #function
-        let filenameURL = URL(fileURLWithPath: filename)
+        let credentialsFilename = "credentials_\(#function)"
+        let credentialsFilenameURL = URL(fileURLWithPath: credentialsFilename)
+
+        let configFilename = "config_\(#function)"
+        let configFilenameURL = URL(fileURLWithPath: configFilename)
 
         let eventLoopGroup = MultiThreadedEventLoopGroup(numberOfThreads: 1)
         let eventLoop = eventLoopGroup.next()
         defer { XCTAssertNoThrow(try eventLoopGroup.syncShutdownGracefully()) }
         let httpClient = HTTPClient(eventLoopGroupProvider: .shared(eventLoop))
         defer { XCTAssertNoThrow(try httpClient.syncShutdown()) }
-        let factory = CredentialProviderFactory.configFile(credentialsFilePath: filenameURL.path)
+
+        let factory = CredentialProviderFactory.configFile(
+            credentialsFilePath: credentialsFilenameURL.path,
+            configFilePath: configFilenameURL.path,
+        )
 
         let provider = factory.createProvider(context: .init(httpClient: httpClient, logger: TestEnvironment.logger, options: .init()))