Serverless using AWS profiles only half working

This is a Bug Report

Description

When using the serverless deploy --aws-profile or using the EXPORT AWS_PROFILE=<profile>; serverless deploy or the AWS_PROFILE=<profile> serverless deploy it only reads from the credentials file, but that should also be reading from the config file like the default aws cli tools does.

For example I have the following two files

~/.aws/config
[default]
aws_access_key_id = <>
aws_secret_access_key = <>

~/.aws/credentials
[profile default]
output = json
region = us-east-1

[profile dev]
role_arn = <cross_account_role>
source_profile = <another_profile>
mfa_serial = <mfa_serial>
region = us-east-1
output = json

If I run serverless deploy --profile dev it will fail with

ServerlessError: AWS provider credentials not found. You can find more info on how to set up provider credentials in our docs here: https://git.io/vXsdd

Then I tried AWS_PROFILE=dev serverless deploy and it failed with the above error

And finally I ran export AWS_PROFILE="dev" && export AWS_REGION=us-east-1 and then ran the serverless deploy and the same error occur.

So reading more in depth the above small link and talking to people on Gitter I moved that dev profile to ~/.aws/config, creating new keys since the previous used a cross account mfa role.

Its my experience using Troposphere and tools that rely on AWS Profiles, they should be looking into all of them and if they have an mfa, request the code about it.

Additional Data

• Serverless Framework Version you’re using: 1.15.3
• Operating System: Mac OS 10.12.5
• Stack Trace: Shown above

Workaround

Create an additional profile and store it inside the ~/.aws/config to use and then you can refer to it using --profile <profile>

[dougireton]

You can use AWS Profiles with Severless, including IAM cross-account role assumption, if you set this environment variable:

export AWS_SDK_LOAD_CONFIG=1

This enables any tool which uses the AWS SDK for Go (e.g. Serverless framework) to use AWS Profiles.

[SkxNMDI5]

Hi, You can make it work by using the right declaration style in your ~/.aws/credentials file :

[dev]
role_arn = <cross_account_role>
source_profile = <another_profile>
....

instead of :

[profile dev]
role_arn = <cross_account_role>
source_profile = <another_profile>
....