specgen SSM resolver: stale static keys in ~/.aws/credentials shadow SSO profile #137

New issue

Closed

opened 2026-06-12 05:00:57 +00:00 by coilysiren · 0 comments

coilysiren commented

2026-06-12 05:00:57 +00:00

Owner

The generated consumer's ssmTokenResolver loads the aws-sdk-go-v2 default config chain, which prefers static keys in ~/.aws/credentials over an SSO profile of the same name in ~/.aws/config. A stale static [default] silently shadows SSO: the API rejects the dead key while the aws CLI (which resolves SSO) keeps working, so only the SDK path breaks and the failure is confusing.

Fix: retry the SSM fetch once with the credentials file excluded (WithSharedCredentialsFiles([]string{}) - non-nil empty slice means "read no credentials file") so the config-file SSO profile can resolve, and print a one-line note naming the shadowing file. Static-only users never reach the retry.

The generated consumer's `ssmTokenResolver` loads the aws-sdk-go-v2 default config chain, which prefers static keys in `~/.aws/credentials` over an SSO profile of the same name in `~/.aws/config`. A stale static `[default]` silently shadows SSO: the API rejects the dead key while the aws CLI (which resolves SSO) keeps working, so only the SDK path breaks and the failure is confusing. Fix: retry the SSM fetch once with the credentials file excluded (`WithSharedCredentialsFiles([]string{})` - non-nil empty slice means "read no credentials file") so the config-file SSO profile can resolve, and print a one-line note naming the shadowing file. Static-only users never reach the retry.

coilysiren referenced this issue from a commit

2026-06-12 05:11:32 +00:00

fix(specgen): retry SSM token fetch without ~/.aws/credentials when static keys shadow SSO

coilysiren closed this issue

2026-06-12 05:11:32 +00:00

coilysiren referenced this issue

2026-06-12 05:12:43 +00:00

Reauthor the kin-openapi parse layer against current specverb (supersedes feat/specverb-kin-parse-layer) #138

coilysiren referenced this issue from a commit

2026-06-14 04:53:32 +00:00

fix(specgen): retry SSM token fetch without ~/.aws/credentials when static keys shadow SSO