credential_process should connect subprocess stderr to caller stderr

[bwalding]

When the botocore is configured to use a credential_process to acquire AWS credentials, the sub-process stderr is never sent to the user.

(In our case, the stderr is prompting for the MFA details to be entered)

stdin is mapped correctly - and if I know that I'm waiting on MFA I can enter it and the process completes successfully.

What I'd hope for - stderr is passed from the credential_process to the stderr on the aws CLI process.

[JordonPhillips]

Off the top of my head I can't think of anything that this behavior change would break. I was initially unsure about using stderr as a prompting source, but when stdout is being used entirely then there's not much other choice. The library we use in our sample implementation uses getpass, which has stderr as a fallback.

Incidentally, getpass is a possible workaround since it tries to write/read from the tty directly first. Most cases that should work, though there is the potential downside of a non-echoing input.

[pcolmer]

Part of the drawback to using getpass to handle this requirement is where the credential process needs to output something more complicated than a single prompt.

For example, in the code I've submitted to enhance awsprocesscreds to support MFA under Okta, the code lists out all of the MFA options available to the user. That could be built up as a single string prompt but it isn't nice for the user to then parse it visually.

[pcolmer]

There is also the scenario where the credential process needs to provide the user with information about the progress of the authentication process. For example, if the user chooses a push notification operation, my code currently emits some text to let the user know that the code is waiting for the result of the push notification. Granted, I could remove that but I think it is more user-friendly if the user is kept informed about what is happening ...

This thread has been stale for a while but it would be nice to know if this is gaining any traction. We have federated logins for AWS and a company policy that requires MFA at login. This means that we need more interaction with the user than just prompting for a password. Not being able to use stdout for anything but the JSON payload, and not being able to use stderr at all limits what you can do with this integration.

[edulop91]

FWIW AWS libraries in other languages already do this:
https://github.com/aws/aws-sdk-go/blob/master/aws/credentials/processcreds/provider.go#L347

[ryan-gerstenkorn-sp]

Wanted to link this PR here as well as add that this would be useful for aws-vault as it prompts to decrypt the credentials when accessed.

#1835

[ryan-gerstenkorn-sp]

Hi all, wanted to post a workaround that can be done through the ~/.aws/config fairly easily. This should work with any executable, not just aws-vault.

[profile develop]
credential_process = sh -c 'aws-vault exec develop --json 2> /dev/tty'
region = us-east-1

I'm not sure why 'sh -c' is required here. I would think it should work without another subprocess but that doesn't seem to be the case.