fix: role assumption through profiles not working properly in certain situations (#14315)

* fix: downgrade credential-providers

* fix: expiration in wrong format

* chore: removed random import

---------

Co-authored-by: aws-amplify-bot <aws@amazon.com>

Author: ShadowCat567

packages/amplify-e2e-core/package.json

@@ -42,7 +42,7 @@
     "@aws-sdk/client-s3": "^3.919.0",
     "@aws-sdk/client-ssm": "^3.919.0",
     "@aws-sdk/client-sts": "^3.919.0",
-    "@aws-sdk/credential-providers": "^3.919.0",
+    "@aws-sdk/credential-providers": "3.721.0",
     "@aws-sdk/lib-dynamodb": "^3.919.0",
     "amplify-headless-interface": "1.17.8",
     "aws-amplify": "^5.3.16",

packages/amplify-e2e-tests/package.json

@@ -44,7 +44,7 @@
     "@aws-sdk/client-s3": "^3.919.0",
     "@aws-sdk/client-ssm": "^3.919.0",
     "@aws-sdk/client-sts": "^3.919.0",
-    "@aws-sdk/credential-providers": "^3.919.0",
+    "@aws-sdk/credential-providers": "3.721.0",
     "@aws-sdk/lib-storage": "^3.919.0",
     "@babel/core": "^7.23.2",
     "@babel/plugin-transform-modules-commonjs": "7.10.4",

packages/amplify-provider-awscloudformation/package.json

@@ -59,7 +59,7 @@
     "@aws-sdk/client-ssm": "^3.919.0",
     "@aws-sdk/client-sts": "^3.919.0",
     "@aws-sdk/credential-provider-node": "^3.919.0",
-    "@aws-sdk/credential-providers": "^3.919.0",
+    "@aws-sdk/credential-providers": "3.721.0",
     "@aws-sdk/lib-dynamodb": "^3.919.0",
     "@aws-sdk/lib-storage": "^3.919.0",
     "@aws-sdk/s3-request-presigner": "^3.919.0",

packages/amplify-provider-awscloudformation/src/index.ts

@@ -107,6 +107,9 @@ async function getConfiguredAWSClientConfig(context, category, action) {
   category = category || 'missing';
   action = action || ['missing'];
   const userAgentAction = `${category}:${action[0]}`;
+  if (credsConfig.credentials && credsConfig.credentials.expiration && typeof credsConfig.credentials.expiration === 'string') {
+    credsConfig.credentials.expiration = new Date(credsConfig.credentials.expiration);
+  }
   const config = {
     credentials: credsConfig.credentials || credsConfig,
     customUserAgent: formUserAgentParam(context, userAgentAction),

packages/amplify-provider-awscloudformation/src/system-config-manager.ts

@@ -93,7 +93,6 @@ export const getProfiledAwsConfig = async (
         ...roleCredentials,
       };
     } else if (profileConfig.credential_process) {
-      // TO DO: need to revisit this
       // need to force AWS_SDK_LOAD_CONFIG to a truthy value to force credential process to prefer the credential process in ~/.aws/config instead of ~/.aws/credentials
       const sdkLoadConfigOriginal = process.env.AWS_SDK_LOAD_CONFIG;
       process.env.AWS_SDK_LOAD_CONFIG = '1';
@@ -175,10 +174,12 @@ const getRoleCredentials = async (context: $TSContext, profileName: string, prof
 
       if (roleData.Credentials) {
         roleCredentials = {
-          accessKeyId: roleData.Credentials.AccessKeyId,
-          secretAccessKey: roleData.Credentials.SecretAccessKey,
-          sessionToken: roleData.Credentials.SessionToken,
-          expiration: roleData.Credentials.Expiration,
+          credentials: {
+            accessKeyId: roleData.Credentials.AccessKeyId,
+            secretAccessKey: roleData.Credentials.SecretAccessKey,
+            sessionToken: roleData.Credentials.SessionToken,
+            expiration: roleData.Credentials.Expiration,
+          },
         };
       }
     } catch (ex) {
@@ -244,7 +245,11 @@ const getCachedRoleCredentials = (roleArn: string, sessionName: string): $TSAny
       return undefined;
     }
   }
-  return roleCredentials;
+  return {
+    credentials: {
+      ...roleCredentials,
+    },
+  };
 };
 
 const validateCachedCredentials = (roleCredentials: $TSAny): boolean => {