How to resolve: 'Unable to resolve AWS account to use. It must be either configured when you define your CDK or through the environment'

Question

I am trying to run CDK commands to check the diff of my local and remote stack.

I am using the following command.

cdk diff --profile saml

I am getting the following error message

Unable to resolve AWS account to use. It must be either configured when you define your CDK or through the environment

I am looking for ways to resolve this issue.

milan · Answer 1 · 2020-06-14T19:17:23.180

25

Removing [profile default] from ~/.aws/config solved it for me.

edited Jun 14 '20 at 19:17

answered Dec 03 '19 at 10:31

milan

11,872
3
42
49

2

Running cdk diff with -v option shows this in the output "Resolving default credentials Unable to determine the default AWS account: TypeError: Cannot redefine property: default". It seems that the "default" profile name clashes with something within the TypeScript code so renaming/removing the "default" profile allows it to work – sDaub Feb 04 '21 at 18:06
1

I somehow had two profiles with the same name in there. So removing one fixed the error. – A Simple Programmer Aug 05 '22 at 21:28
3

@ASimpleProgrammer I've had this happen. Usually two profiles with the same name is from doing `aws configure sso` twice. It adds a new entry each time – Kellen Stuart Nov 02 '22 at 20:20

score 7 · Answer 2 · answered Nov 24 '20 at 11:31

In my case it had nothing to do with the proposed solutions.
If you add the -v (verbose) argument to cdk command, you will see the actual error: Unable to determine the default AWS account: TypeError [ERR_INVALID_PROTOCOL]: Protocol "https:" not supported. Expected "http:"

I tried different versions of CDK and nothing, still the same error. After many tries I ended up with the root cause: node version. With v15.2.1 I got that error, but after downgrading to v14.15.1 the issue was solved.

score 5 · Answer 3 · answered Jan 31 '20 at 22:35

Finally I used following in C:\XXXX.aws\credentials

[default]
aws_access_key_id=XXXXXXXXXXXXXX
aws_secret_access_key=XXXXXXXXXXXX

and cmd:> cdk deploy --profile default

However this didn't work.

[project1]
aws_access_key_id = ANOTHER_AWS_ACCESS_KEY_ID
aws_secret_access_key = ANOTHER_AWS_SECRET_ACCESS_KEY

and cmd:> cdk deploy --profile project1

Error: AWS region must be configured either when you configure your CDK stack or through the environment

score 4 · Answer 4 · answered Nov 20 '19 at 21:59

You need to specify your credentials. Check out this article: https://docs.aws.amazon.com/cdk/latest/guide/getting_started.html#getting_started_credentials

It gives details on how to do this:

Specifying Your Credentials and Region

You must specify your credentials and an AWS Region to use the AWS CDK CLI. The CDK looks for credentials and region in the following order:

Using the --profile option to cdk commands.

Using environment variables.

Using the default profile as set by the AWS Command Line Interface (AWS CLI).

You can set up a profile using the AWS CLI. See https://docs.aws.amazon.com/cli/latest/userguide/cli-chap-configure.html for details on how to do this. You can specify named profiles, such as a profile for each account, and then specify the profile name to use for your CDK call.

So I have done this and I have used the --profile but it didn't work — Drew Gallagher, Nov 21 '19 at 03:49

score 4 · Answer 5 · edited Nov 01 '20 at 12:21

4

In your .aws folder, create/add an empty file named credentials without the file extension.

edited Nov 01 '20 at 12:21

Elletlar

3,136
7
32
38

answered Nov 01 '20 at 00:52

Alex Wood

41
1

score 3 · Answer 6 · answered Jan 21 '22 at 21:29

The error is produced by CDK because it can't resolve valid AWS CLI credentials which allows it to resolve the account by making a call similar to

aws sts get-caller-identity --profile profile_name

There are multiple ways to configure the AWS CLI with valid credentials so that CDK can interact with the CLI configuration to obtain credentials

In ~/.aws/credentials, which is easiest and least preferred/secure way due to using longterm creds, you can place longterm credentials assigned to an IAM user like this

    [default]
    aws_access_key_id=AKIAI44QH8DHBEXAMPLE
    aws_secret_access_key=je7MtGbClwBF/2Zp9Utk/h3yCo8nvbEXAMPLEKEY

Using credential process https://docs.aws.amazon.com/cli/latest/userguide/cli-configure-sourcing-external.html

In ~/.aws/config

[profile developer]
credential_process = /opt/bin/awscreds-custom --username helen

Using a more secure tool like https://github.com/99designs/aws-vault
Using AWS CLI integration with AWS SSO. This setup allows for SSO across multiple accounts and supports multiple MFA strategies including biometric. The problem with this is that the current version of the CDK has not been updated to use the latest version of the Node AWS SDK so it does not know how to retrieve credentials. Hopefully a future release of CDK will resolve this but its been almost 2 years

In ~/.aws/config

[profile sso_profile]
sso_start_url = https://sso_url.awsapps.com/start
sso_region = us-east-2
sso_account_id =
sso_role_name = AWSAdministratorAccess
region = us-east-2
output=json

Fortunately there is a decent workaround which works seamlessly once configured. This involves utilizing a python lib that can expose an SSO profile as a credentials process which is supported by current CDK. Install https://pypi.org/project/aws2-wrap/

pip3 install aws2-wrap==1.2.7

Then in ~/.aws/config add a wrapper profile that uses aws2-wrap to exposes as a credentials process

[profile wrapped_sso_profile]
region = us-east-2
credential_process = aws2-wrap --process --profile sso_profile

If you use SSO and don't want to install the Python lib, you can just call `export AWS_PROFILE=` and then `aws sso login` manually. Afterwards, `cdk deploy` works as expected for me. — Elias Strehle, Jul 23 '22 at 09:11

score 2 · Answer 7 · answered Nov 21 '19 at 09:18

2

You should explicitly set your account and region when initializing your stacks. AWS CDK CLI provides two environment variables, CDK_DEFAULT_ACCOUNT and CDK_DEFAULT_REGION, to determine the target at synthesis time.

new MyDevStack(app, 'dev', { 
  env: { 
    account: process.env.CDK_DEFAULT_ACCOUNT, 
    region: process.env.CDK_DEFAULT_REGION 
}});

If you use these environment variables, the target account and region are fetched from your active AWS profile, e.g. --profile option.

https://docs.aws.amazon.com/cdk/latest/guide/environments.html

answered Nov 21 '19 at 09:18

Vikyol

5,051
23
24

1

Ok this makes sense however when I run 'cdk diff --profile ' it still gives me the same error. – Drew Gallagher Nov 21 '19 at 14:30
The docs also suggest this is "acceptable or even desirable during development, but it would probably be an anti-pattern for production use" and recommend using it as a fall-back instead e.g. `account: process.env.CDK_DEPLOY_ACCOUNT || process.env.CDK_DEFAULT_ACCOUNT,` – Davos May 18 '21 at 04:51

score 1 · Answer 8 · answered Jul 12 '22 at 01:47

sudo was killing me...

I was getting the same error for cdk deploy. I kept running:

$ sudo cdk deploy --profile default

and getting the same error. I eventually used -v and read every line and realized it wasn't using my .aws/credentials file, but was looking for /root/.aws/credentials.

Removed sudo and everything worked just fine.

$ cdk deploy --profile default

score 1 · Answer 9 · answered May 19 '23 at 15:31

1

If you're using aws sso as your login method, once your source .venv/bin/active execute the following to setup your session:

aws sso login --profile profile_name

Then execute:

cdk deploy --profile profile_name

answered May 19 '23 at 15:31

Tony

500
6
14

score 0 · Answer 10 · answered May 04 '20 at 12:00

0

You might be suffering from https://github.com/aws/aws-cdk/issues/5455

To work around, don't use a profile, grab access keys (your org should have a way) and export these to the environment

answered May 04 '20 at 12:00

Otto

1,787
1
17
25

score 0 · Answer 11 · answered Jun 25 '20 at 15:53

0

Not sure if this help, but in my organization we use AWS SSO, with over 90 AWS Accounts, with MFA, so it was impossible to manage CDK without AWS CLIv2 with profiles, and AWS SSO support.

I found a way to solve it, so till its officially relesed, you can use this, it works quite all right: MatsCloud blog - CDK with AWS SSO multi account multi profile

answered Jun 25 '20 at 15:53

Mat Jovanovic

11
3

see my answer in this topic for a more seamless way to achieve this with SSO – Robert Hutto Jan 21 '22 at 21:34

score 0 · Answer 12 · answered Dec 07 '20 at 08:33

0

in ~/.aws/config the tag [default] must be alone in a new row Example:

[someBasicUser]
[default]
aws_access_key_id = XXXXXXXXXXXXXX
aws_secret_access_key = XXXXXXXXXXXXXX

answered Dec 07 '20 at 08:33

vencedor

663
7
9

score 0 · Answer 13 · answered Oct 17 '21 at 12:05

I my case I created new access key's in AWS fist, which I used then as descruped above.

aws configure aws_access_key_id aws_secret_access_key then enter your region

Then it worked. So I assume when the error is "Unable to resolve AWS account" you have the issue new access keys, as the current one is obviously not valid anymore.

enter image description here

score 0 · Answer 14 · answered Oct 28 '21 at 17:31

0

I just came across this, because I had the same issue...

using THE SAME profile idenitiefer fixed it for my :D

I was using an _ where as the profile name contained a -...

answered Oct 28 '21 at 17:31

wzr1337

3,609
5
30
53

score 0 · Answer 15 · answered Jan 28 '22 at 02:39

AWS CLI v2 is capable of using AWS SSO to acquire credentials natively; however the SDK that was used to develop AWS CDK is not capable of using AWS SSO natively to acquire the credentials. Hence, "credential_process" must be configured in ~/.aws/config to acquire credentials.

While configuring "credential_process", I found they python package "aws2-wrap" (pip install aws2-wrap) as simple and straightforward. The other package "aws-sso-credential-process" required pipx which itself installed python@3.10 on my Mac.

score 0 · Answer 16 · answered Apr 04 '22 at 23:14

0

In my case I was running the command:

npm run cdk diff my-stack --profile MyProfile

However it worked when I changed to use

npx cdk diff my-stack --profile MyProfile

This is because npm run x does not pass through --parameters to child processes.

answered Apr 04 '22 at 23:14

Kim T

5,770
1
52
79

Arturo Perez · Answer 17 · 2022-04-11T12:53:08.440

0

I just created a new profile.

aws configure --profile profile2

aws_access_key_id=XXXXXXXXXXXXXX
aws_secret_access_key=XXXXXXXXXXXX
region = us-west-2
output=text

cdk deploy --profile profile2

I tried various things and this finally helped. Just a quick note, I never added an output until the last one. Maybe a completely filled out profile helped as well.

reference: https://docs.aws.amazon.com/cli/latest/userguide/cli-configure-quickstart.html

edited Apr 11 '22 at 12:53

answered Apr 09 '22 at 20:40

Arturo Perez

1
1

Your answer could be improved with additional supporting information. Please [edit] to add further details, such as citations or documentation, so that others can confirm that your answer is correct. You can find more information on how to write good answers [in the help center](/help/how-to-answer). – Community Apr 10 '22 at 05:53
`'cdk' is not recognized as an internal or external command, operable program or batch file.` – john k Sep 23 '22 at 19:51

score 0 · Answer 18 · answered Oct 29 '22 at 19:32

0

In my case, when I specified my credentials using aws configure, when I pasted the apiKey it included an special character in the beginning of the credential causing this issue. So I edited the ./aws/credentials file and removed it.

answered Oct 29 '22 at 19:32

Glim

361
1
10

score 0 · Answer 19 · answered Nov 23 '22 at 20:57

0

I tried everything and in the end it was the unadjusted clock of WSL2

Fixed with

sudo ntpdate pool.ntp.org

answered Nov 23 '22 at 20:57

Matias Haeussler

1,061
2
12
25

score 0 · Answer 20 · answered Dec 01 '22 at 17:49

For me it seemed the CDK had cached a bad session and wouldn't clear it. I deleted the following directory in my home directory

    rm -Rf ~/.cdk/cache

That worked for me as it forced creation of a new cache. (be careful you're deleting the correct dir :)

score 0 · Answer 21 · answered Dec 06 '22 at 18:07

0

in my case, i change region name to region code

from: Asia Pacific (Singapore) to: ap-southeast-1

answered Dec 06 '22 at 18:07

Imam Mubin

294
2
10

score 0 · Answer 22 · answered Dec 14 '22 at 17:09

0

I use AWS SSO and sometimes experience this issue when my session has expired. Calling aws sso login will still seem like it's working fine for a minute or two, but calling cdk deploy (or something similar) already fails.

answered Dec 14 '22 at 17:09

Elias Strehle

1,722
1
21
34

score 0 · Answer 23 · answered Mar 07 '23 at 12:28

0

AWS will give you the same error if you don't provide a valid aws_access_key_id and aws_secret_access_key.

answered Mar 07 '23 at 12:28

banty

1,019
1
8
9

score 0 · Answer 24 · answered Mar 07 '23 at 19:09

0

Only when I explicitly exported my creds did it work:

export AWS_ACCESS_KEY_ID=...
export AWS_SECRET_ACCESS_KEY=...

answered Mar 07 '23 at 19:09

ChrisDanger

1,071
11
10

score 0 · Answer 25 · answered Apr 12 '23 at 10:30

For me this was caused by a discrepancy in the system time. As others have said, running

cdk diff -v

And carefully reading through the output helped. I found a message like this:

Unable to determine the default AWS account (SignatureDoesNotMatch): Signature expired: 20230412T092243Z is now earlier than 20230412T100504Z (20230412T102004z - 15 mins)

When I checked my laptop time had not updated with daylight savings.

score 0 · Answer 26 · answered Apr 25 '23 at 15:59

If you have multiple profiles in your ~/.aws/config, for instance,

[profile prod]
sso_start_url = https://sso.com
sso_region = us-east-1
sso_account_id = <account_id>
sso_role_name = <role_name>
region = us-east-1
output = json


[profile dev]
sso_start_url = https://sso.com
sso_region = us-east-1
sso_account_id = <account_id>
sso_role_name = <role_name>
region = us-east-1
output = json

Then run your CDK command specifying the profile you want to use in an environment variable.

AWS_PROFILE=dev cdk diff

score -3 · Answer 27 · answered Jul 06 '21 at 09:33

-3

Just type

aws configure

in your shell and then type

aws_access_key_id

aws_secret_access_key

then enter your region

if you are not confirm with your region sign in to Console

then have a look at the end of url-bar im sure you find it.

answered Jul 06 '21 at 09:33

Nauman

8
3

How to resolve: 'Unable to resolve AWS account to use. It must be either configured when you define your CDK or through the environment'

27 Answers27

Linked