v5 pwsh session no longer detects credential change?

[nwsparks]

in our environment we need to regenerate credentials every hour. im using a shared credential file ~/.aws/credentials

in order to generate new credentials I'm running this https://github.com/venth/aws-adfs from bash which is updating the shared credential file.

prior to upgrading to v5, when the value of that file would change, pwsh would seamlessly pick it up. after upgrading to v5 i have to restart the pwsh session. I'm also having difficult when changing accounts as it seems to be caching the old account somehow.

[AlexDaines]

Hey @nwsparks, seems you're hitting a behavior change in how the underlying (.NET) SDK caches credentials in v5.

When PS Tools resolves credentials from ~/.aws/credentials, it reads the file once and snapshots the keys into an immutable credentials object that gets cached in $StoredAWSCredentials. The new credential resolution in v5 has a layer that watches for changes to environment variables (AWS_ACCESS_KEY_ID, AWS_PROFILE, etc.) but doesn't currently monitor the credentials file itself for changes. So when aws-adfs writes new creds to the file, the cached object has no idea.

The account switching issue is the same thing, stale cached credentials from the previous profile.

Quickest workaround, after your aws-adfs rotation completes just run:

Clear-AWSCredential

That clears the session cache so the next cmdlet call re-reads from disk. You can also do Set-AWSCredential -ProfileName default to force a reload into the session, or pass -ProfileName default directly on each cmdlet call if you want to skip the session cache entirely.

If you're scripting the rotation you could chain it:

# after aws-adfs finishes:
Clear-AWSCredential

Going to convert this to an issue since the credential resolution layer should probably be watching the file for changes, not just env vars. Thanks for flagging this.

[sankettangade]

Hi @nwsparks,

Thanks for reporting this issue. The issue has been fixed now in AWS Tools for PowerShell version 5.0.233 and further.