{"action":"created","issue":{"url":"https://api.github.com/repos/aws/aws-cli/issues/1612","labels_url":"https://api.github.com/repos/aws/aws-cli/issues/1612/labels{/name}","comments_url":"https://api.github.com/repos/aws/aws-cli/issues/1612/comments","events_url":"https://api.github.com/repos/aws/aws-cli/issues/1612/events","html_url":"https://github.com/aws/aws-cli/issues/1612","id":114631638,"number":1612,"title":"Assume role with profile throws KeyError: 'aws_access_key_id'","user":{"login":"pbudzon","id":1087886,"avatar_url":"https://avatars.githubusercontent.com/u/1087886?v=3","gravatar_id":"","url":"https://api.github.com/users/pbudzon","html_url":"https://github.com/pbudzon","followers_url":"https://api.github.com/users/pbudzon/followers","following_url":"https://api.github.com/users/pbudzon/following{/other_user}","gists_url":"https://api.github.com/users/pbudzon/gists{/gist_id}","starred_url":"https://api.github.com/users/pbudzon/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/pbudzon/subscriptions","organizations_url":"https://api.github.com/users/pbudzon/orgs","repos_url":"https://api.github.com/users/pbudzon/repos","events_url":"https://api.github.com/users/pbudzon/events{/privacy}","received_events_url":"https://api.github.com/users/pbudzon/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":1,"created_at":"2015-11-02T16:31:54Z","updated_at":"2015-11-02T16:53:55Z","closed_at":null,"body":"Hi,\r\n\r\nI'm trying to assume a role through a cli profile, as described here: http://docs.aws.amazon.com/cli/latest/userguide/cli-roles.html\r\n\r\nI have an EC2 instance with an instance role with permissions to assume a role on another account.\r\nAWS CLI version:\r\n```aws-cli/1.9.2 Python/2.7.6 Linux/3.13.0-48-generic botocore/1.3.2```\r\n\r\nMy `.aws/config`:\r\n```\r\n[default]\r\nregion = eu-west-1\r\n\r\n[profile somerole-1234]\r\nsource_profile=default\r\nrole_arn=arn:aws:iam::1234:role/somerole\r\n```\r\n\r\nRunning `aws sts assume-role --role-arn arn:aws:iam::1234:role/somerole --role-session-name test` returns credentials information as intended.\r\nBut if I run `aws --profile somerole-1234 --debug ...` I get the following error:\r\n```\r\n2015-11-02 16:04:39,685 - MainThread - awscli.clidriver - DEBUG - CLI version: aws-cli/1.9.2 Python/2.7.6 Linux/3.13.0-48-generic botocore/1.3.2\r\n2015-11-02 16:04:39,685 - MainThread - awscli.clidriver - DEBUG - Arguments entered to CLI: ['rds', 'describe-db-snapshots', '--profile', 'cnidev-800540593336', '--debug']\r\n2015-11-02 16:04:39,685 - MainThread - botocore.hooks - DEBUG - Event session-initialized: calling handler <function add_scalar_parsers at 0x7f90452f29b0>\r\n2015-11-02 16:04:39,685 - MainThread - botocore.hooks - DEBUG - Event session-initialized: calling handler <function inject_assume_role_provider at 0x7f904554b050>\r\n2015-11-02 16:04:39,717 - MainThread - botocore.hooks - DEBUG - Event service-data-loaded.rds: calling handler <function register_retries_for_service at 0x7f9045afca28>\r\n2015-11-02 16:04:39,717 - MainThread - botocore.handlers - DEBUG - Registering retry handlers for service: rds\r\n2015-11-02 16:04:39,719 - MainThread - botocore.hooks - DEBUG - Event building-command-table.rds: calling handler <function _building_command_table at 0x7f9045621500>\r\n2015-11-02 16:04:39,719 - MainThread - botocore.hooks - DEBUG - Event service-data-loaded.rds: calling handler <function register_retries_for_service at 0x7f9045afca28>\r\n2015-11-02 16:04:39,720 - MainThread - botocore.handlers - DEBUG - Registering retry handlers for service: rds\r\n2015-11-02 16:04:39,720 - MainThread - botocore.hooks - DEBUG - Event building-command-table.rds: calling handler <function add_waiters at 0x7f904554bde8>\r\n2015-11-02 16:04:39,721 - MainThread - awscli.clidriver - DEBUG - OrderedDict([(u'db-instance-identifier', <awscli.arguments.CLIArgument object at 0x7f9044f65f90>), (u'db-snapshot-identifier', <awscli.arguments.CLIArgument object at 0x7f9044f65fd0>), (u'snapshot-type', <awscli.arguments.CLIArgument object at 0x7f9044f65cd0>), (u'filters', <awscli.arguments.ListArgument object at 0x7f9044f7b050>), (u'max-records', <awscli.arguments.CLIArgument object at 0x7f9044f7b090>), (u'marker', <awscli.arguments.CLIArgument object at 0x7f9044f7b0d0>)])\r\n2015-11-02 16:04:39,721 - MainThread - botocore.hooks - DEBUG - Event building-argument-table.rds.describe-db-snapshots: calling handler <function add_streaming_output_arg at 0x7f90456ecb90>\r\n2015-11-02 16:04:39,722 - MainThread - botocore.hooks - DEBUG - Event building-argument-table.rds.describe-db-snapshots: calling handler <function add_cli_input_json at 0x7f904553d410>\r\n2015-11-02 16:04:39,722 - MainThread - botocore.hooks - DEBUG - Event building-argument-table.rds.describe-db-snapshots: calling handler <function unify_paging_params at 0x7f904568dd70>\r\n2015-11-02 16:04:39,722 - MainThread - awscli.customizations.paginate - DEBUG - Modifying paging parameters for operation: DescribeDBSnapshots\r\n2015-11-02 16:04:39,722 - MainThread - botocore.hooks - DEBUG - Event building-argument-table.rds.describe-db-snapshots: calling handler <function add_generate_skeleton at 0x7f904553d758>\r\n2015-11-02 16:04:39,723 - MainThread - botocore.hooks - DEBUG - Event before-building-argument-table-parser.rds.describe-db-snapshots: calling handler <bound method CliInputJSONArgument.override_required_args of <awscli.customizations.cliinputjson.CliInputJSONArgument object at 0x7f9044f7b110>>\r\n2015-11-02 16:04:39,723 - MainThread - botocore.hooks - DEBUG - Event before-building-argument-table-parser.rds.describe-db-snapshots: calling handler <bound method GenerateCliSkeletonArgument.override_required_args of <awscli.customizations.generatecliskeleton.GenerateCliSkeletonArgument object at 0x7f9044f7b410>>\r\n2015-11-02 16:04:39,724 - MainThread - botocore.hooks - DEBUG - Event operation-args-parsed.rds.describe-db-snapshots: calling handler <functools.partial object at 0x7f9044f5a520>\r\n2015-11-02 16:04:39,724 - MainThread - botocore.hooks - DEBUG - Event load-cli-arg.rds.describe-db-snapshots.db-instance-identifier: calling handler <function uri_param at 0x7f90456d5c08>\r\n2015-11-02 16:04:39,724 - MainThread - botocore.hooks - DEBUG - Event load-cli-arg.rds.describe-db-snapshots.db-snapshot-identifier: calling handler <function uri_param at 0x7f90456d5c08>\r\n2015-11-02 16:04:39,724 - MainThread - botocore.hooks - DEBUG - Event load-cli-arg.rds.describe-db-snapshots.snapshot-type: calling handler <function uri_param at 0x7f90456d5c08>\r\n2015-11-02 16:04:39,724 - MainThread - botocore.hooks - DEBUG - Event load-cli-arg.rds.describe-db-snapshots.filters: calling handler <function uri_param at 0x7f90456d5c08>\r\n2015-11-02 16:04:39,724 - MainThread - botocore.hooks - DEBUG - Event load-cli-arg.rds.describe-db-snapshots.max-records: calling handler <function uri_param at 0x7f90456d5c08>\r\n2015-11-02 16:04:39,724 - MainThread - botocore.hooks - DEBUG - Event load-cli-arg.rds.describe-db-snapshots.marker: calling handler <function uri_param at 0x7f90456d5c08>\r\n2015-11-02 16:04:39,724 - MainThread - botocore.hooks - DEBUG - Event load-cli-arg.rds.describe-db-snapshots.cli-input-json: calling handler <function uri_param at 0x7f90456d5c08>\r\n2015-11-02 16:04:39,725 - MainThread - botocore.hooks - DEBUG - Event load-cli-arg.rds.describe-db-snapshots.starting-token: calling handler <function uri_param at 0x7f90456d5c08>\r\n2015-11-02 16:04:39,725 - MainThread - botocore.hooks - DEBUG - Event load-cli-arg.rds.describe-db-snapshots.page-size: calling handler <function uri_param at 0x7f90456d5c08>\r\n2015-11-02 16:04:39,725 - MainThread - botocore.hooks - DEBUG - Event load-cli-arg.rds.describe-db-snapshots.max-items: calling handler <function uri_param at 0x7f90456d5c08>\r\n2015-11-02 16:04:39,725 - MainThread - botocore.hooks - DEBUG - Event load-cli-arg.rds.describe-db-snapshots.generate-cli-skeleton: calling handler <function uri_param at 0x7f90456d5c08>\r\n2015-11-02 16:04:39,725 - MainThread - botocore.hooks - DEBUG - Event calling-command.rds.describe-db-snapshots: calling handler <bound method GenerateCliSkeletonArgument.generate_json_skeleton of <awscli.customizations.generatecliskeleton.GenerateCliSkeletonArgument object at 0x7f9044f7b410>>\r\n2015-11-02 16:04:39,725 - MainThread - botocore.hooks - DEBUG - Event calling-command.rds.describe-db-snapshots: calling handler <bound method CliInputJSONArgument.add_to_call_parameters of <awscli.customizations.cliinputjson.CliInputJSONArgument object at 0x7f9044f7b110>>\r\n2015-11-02 16:04:39,725 - MainThread - botocore.credentials - DEBUG - Looking for credentials via: assume-role\r\n2015-11-02 16:04:39,725 - MainThread - awscli.customizations.assumerole - DEBUG - Retrieving credentials via AssumeRole.\r\n2015-11-02 16:04:39,725 - MainThread - awscli.clidriver - DEBUG - Exception caught in main()\r\nTraceback (most recent call last):\r\n  File \"/usr/local/lib/python2.7/dist-packages/awscli/clidriver.py\", line 184, in main\r\n    return command_table[parsed_args.command](remaining, parsed_args)\r\n  File \"/usr/local/lib/python2.7/dist-packages/awscli/clidriver.py\", line 369, in __call__\r\n    return command_table[parsed_args.operation](remaining, parsed_globals)\r\n  File \"/usr/local/lib/python2.7/dist-packages/awscli/clidriver.py\", line 538, in __call__\r\n    call_parameters, parsed_globals)\r\n  File \"/usr/local/lib/python2.7/dist-packages/awscli/clidriver.py\", line 655, in invoke\r\n    verify=parsed_globals.verify_ssl)\r\n  File \"/usr/local/lib/python2.7/dist-packages/botocore/session.py\", line 754, in create_client\r\n    credentials = self.get_credentials()\r\n  File \"/usr/local/lib/python2.7/dist-packages/botocore/session.py\", line 413, in get_credentials\r\n    'credential_provider').load_credentials()\r\n  File \"/usr/local/lib/python2.7/dist-packages/botocore/credentials.py\", line 602, in load_credentials\r\n    creds = provider.load()\r\n  File \"/usr/local/lib/python2.7/dist-packages/awscli/customizations/assumerole.py\", line 186, in load\r\n    return self._load_creds_via_assume_role()\r\n  File \"/usr/local/lib/python2.7/dist-packages/awscli/customizations/assumerole.py\", line 205, in _load_creds_via_assume_role\r\n    creds, response = self._retrieve_temp_credentials()\r\n  File \"/usr/local/lib/python2.7/dist-packages/awscli/customizations/assumerole.py\", line 305, in _retrieve_temp_credentials\r\n    client = self._create_client_from_config(config)\r\n  File \"/usr/local/lib/python2.7/dist-packages/awscli/customizations/assumerole.py\", line 296, in _create_client_from_config\r\n    'sts', aws_access_key_id=source_cred_values['aws_access_key_id'],\r\nKeyError: 'aws_access_key_id'\r\n2015-11-02 16:04:39,726 - MainThread - awscli.clidriver - DEBUG - Exiting with rc 255\r\n\r\n'aws_access_key_id'\r\n```\r\n\r\nI'm trying to assume the role on another account to perform an action on this account. **This works correctly when access key and secret to a user account are placed inside the `.aws/credentials` file in the default profile.** I have moved the policies from the user account to the instance role as it seemed like a better solution that storing the credentials on the machine. \r\n\r\nMy `.aws/credentials` file is currently empty. Please let me know if I'm doing something completely unsupported here! Although the documentation (http://docs.aws.amazon.com/cli/latest/userguide/cli-roles.html) and the output of the command seem to indicate that I'm on the right track here :) "},"comment":{"url":"https://api.github.com/repos/aws/aws-cli/issues/comments/153081310","html_url":"https://github.com/aws/aws-cli/issues/1612#issuecomment-153081310","issue_url":"https://api.github.com/repos/aws/aws-cli/issues/1612","id":153081310,"user":{"login":"pbudzon","id":1087886,"avatar_url":"https://avatars.githubusercontent.com/u/1087886?v=3","gravatar_id":"","url":"https://api.github.com/users/pbudzon","html_url":"https://github.com/pbudzon","followers_url":"https://api.github.com/users/pbudzon/followers","following_url":"https://api.github.com/users/pbudzon/following{/other_user}","gists_url":"https://api.github.com/users/pbudzon/gists{/gist_id}","starred_url":"https://api.github.com/users/pbudzon/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/pbudzon/subscriptions","organizations_url":"https://api.github.com/users/pbudzon/orgs","repos_url":"https://api.github.com/users/pbudzon/repos","events_url":"https://api.github.com/users/pbudzon/events{/privacy}","received_events_url":"https://api.github.com/users/pbudzon/received_events","type":"User","site_admin":false},"created_at":"2015-11-02T16:53:55Z","updated_at":"2015-11-02T16:53:55Z","body":"I think this is a duplicate of #1604 \r\nI don't understand why this is working when access keys are specified, but not when the access is granted via EC2 instance role?"}}