VSCode Kubernetes Extension: Unable to parse config file .aws/config

Question

Using latest VSCode and the plugin version.

AWS Toolkit is working fine.

kubectl get pods works fine from terminal.

Kubernetes extension showing the cluster name, BUT while trying to open Nodes or other things getting this error:

Unable to parse config file: /Users/yurib/.aws/config Unable to parse config file: /Users/yurib/.aws/config Unable to parse config file: /Users/yurib/.aws/config Unable to parse config file: /Users/yurib/.aws/config Unable to parse config file: /Users/yurib/.aws/config Unable to connect to the server: getting credentials: exec: executable aws failed with exit code 255

No logs, nothing...

config:

[okta]
# Okta Dev APP
#####################
aws_saml_url = home/amazon_aws/adfdglkdfgkldfgj/274


# Dev is the HUB account
#########################
[profile dev]
# Role to assume - each team will use it’s own role
role_arn = arn:aws:iam::xxxxxxxx:role/okta-admin-role
region = us-east-1
# source_profile = dev
session_ttl = 12h


#Spoke Accounts
###################

[profile development]
# Role to assume - each team will use it’s own role
role_arn = arn:aws:iam::xxxxxxxx:role/okta-admin-role
region = us-east-1
source_profile = dev
session_ttl = 12h

#Staging
##########

[profile staging]
source_profile = dev
role_arn = arn:aws:iam::xxxxxxxx:role/aws-okta-admin-role
region = us-east-1
assume_role_ttl = 1h

#GAS
##########

[profile gass]
source_profile = dev
role_arn = arn:aws:iam::xxxxxxxx:role/aws-okta-admin-role
region = us-east-1
assume_role_ttl = 1h


#CRISPR
###########

[profile cris]
source_profile = dev
role_arn = arn:aws:iam::xxxxxxxx:role/aws-okta-admin-role
region = eu-west-1
assume_role_ttl = 1h

credentials:

[dev]
aws_access_key_id     = XXXXXXXXX
aws_secret_access_key = XXXXXX
aws_session_token     = XXXXXXXXX
aws_security_token    = XXXXXXXXX

[gas]
aws_access_key_id     = XXXXXXXXX
aws_secret_access_key = XXXXXXXXX
aws_session_token     = XXXXXXXXX
aws_security_token    = XXXXXXXXX

[crispr]
aws_access_key_id     = XXXXXXXXX
aws_secret_access_key = XXXXXXXXX
aws_session_token     = XXXXXXXXX
aws_security_token    = XXXXXXXXX

The cluster is on CRISPR account.

kubeconfig is ok.

Answer 1

I've seen this error when the config file has utf8 encoding as yours does. Sometimes changing the encoding to ansi resolves this issue.

Another solution is to rename/move/delete the config file which has this issue, then create a clean version using the aws cli itself, using aws configure set. Just follow aws configure set with the section name (the bit in the square brackets of the config file) replacing spaces with dots, then a dot and the setting name followed by a space and the setting's value.

aws configure set okta.aws_saml_url home/amazon_aws/adfdglkdfgkldfgj/274

aws configure set profile.dev.role_arn arn:aws:iam::xxxxxxxx:role/okta-admin-role
aws configure set profile.dev.region us-east-1
aws configure set profile.dev.session_ttl 12h

aws configure set profile.development.role_arn arn:aws:iam::xxxxxxxx:role/okta-admin-role
aws configure set profile.development.region us-east-1
aws configure set profile.development.source_profile dev
aws configure set profile.development.session_ttl 12h

aws configure set profile.staging.source_profile dev
aws configure set profile.staging.role_arn arn:aws:iam::xxxxxxxx:role/aws-okta-admin-role
aws configure set profile.staging.region us-east-1
aws configure set profile.staging.assume_role_ttl 1h

aws configure set profile.gass.source_profile dev
aws configure set profile.gass.role_arn arn:aws:iam::xxxxxxxx:role/aws-okta-admin-role
aws configure set profile.gass.region us-east-1
aws configure set profile.gass.assume_role_ttl 1h

aws configure set profile.cris.source_profile dev
aws configure set profile.cris.role_arn arn:aws:iam::xxxxxxxx:role/aws-okta-admin-role
aws configure set profile.cris.region eu-west-1
aws configure set profile.cris.assume_role_ttl 1h

Answer 2

In my case, there were duplicate entries of profiles.

Answer 3

I rearranged the config file and it works now.

Working aws config:

[okta]
aws_saml_url = home/amazon_aws/yyYYhshdYndmd/313

[profile dev]
source_profile = dev
role_arn = arn:aws:iam::xxxxxxxxxxxx:role/okta-admin-role
region = us-east-1
session_ttl = 12h


[profile cris]
source_profile = dev
role_arn = arn:aws:iam::xxxxxxxxxxxx:role/aws-okta-admin-role
region = eu-west-1
assume_role_ttl = 1h


[profile staging]
source_profile = dev
role_arn = arn:aws:iam::xxxxxxxxxxxx:role/aws-okta-admin-role
region = us-east-1
assume_role_ttl = 1h


[profile rnla]
source_profile = dev
role_arn = arn:aws:iam::xxxxxxxxxxxx:role/aws-okta-admin-role
region = us-east-1
assume_role_ttl = 1h

Answer 4

according to the docs

should config looks like that:

[default]
aws_access_key_id = xxxxxxxxxxxxxxx
aws_secret_access_key = yyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyy

I had found previously broken config on my Mac:

# Amazon Web Services Config File used by AWS CLI, SDKs, and tools
# This file was created by the AWS Toolkit for JetBrains plugin.
#
# Your AWS credentials are represented by access keys associated with IAM users.
# For information about how to create and manage AWS access keys for a user, see:
# https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_access-keys.html
#
# This config file can store multiple access keys by placing each one in a
# named "profile". For information about how to change the access keys in a
# profile or to add a new profile with a different access key, see:
# https://docs.aws.amazon.com/cli/latest/userguide/cli-config-files.html
#
# If both a credential and config file exists, the values in the credential file
# take precedence

[default]
# The access key and secret key pair identify your account and grant access to AWS.
aws_access_key_id = [accessKey]
# Treat your secret key like a password. Never share your secret key with anyone. Do
# not post it in online forums, or store it in a source control system. If your secret
# key is ever disclosed, immediately use IAM to delete the access key and secret key
# and create a new key pair. Then, update this file with the replacement key details.
aws_secret_access_key = [secretKey]

# [profile user1]
aws_access_key_id = xxxxxxxxxxxxxxx
aws_secret_access_key = yyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyy