Profile based credentials don't work with credential_process

• I’m submitting a …

  • 🪲 bug report
  • 🚀 feature request
  • 📚 construct library gap
  • ☎️ security issue or vulnerability => Please see policy
  • ❓ support request => Please see note at the top of this template.

• What is the current behavior? If the current behavior is a 🪲bug🪲: Please provide the steps to reproduce

When using --profile (see also #3007), the CLI doesn’t respect credential_process. The profile has to have hardcoded credentials.

• What is the expected behavior (or behavior of feature suggested)?

credentials_process is respected and invoked the same way other AWS CLI tools do.

• What is the motivation / use case for changing the behavior or adding this feature?

Parity with AWS CLI.

• Please tell us about your environment:

  • CDK CLI Version: 0.35.0
  • Module Version: 0.35.0
  • OS: macOS Mojave
  • Language: TypeScript

[rclark]

https://github.com/aws/aws-cdk/blob/986e2814e072f0334d8470a2d60ea73dcceadfe4/packages/aws-cdk/lib/api/aws-auth/awscli-compatible.ts#L42-L45

I can hack my way to making this work by adding a line here, though there may be other consequences…

    const sources = [
      () => new AWS.EnvironmentCredentials('AWS'),
      () => new AWS.EnvironmentCredentials('AMAZON'),
      () => new AWS.ProcessCredentials({ profile }),
    ];

[shivlaks]

marking as p1 to prioritize a fix