Can't use --prompt=terminal with --ec2-server on Linux about aws-vault

[MartinLoeper]

I am running into the same issue. We are using AWS Identity Center as SSO solution. It would be ideal if the background process would just open a browser window to re-authenticate if the session expires. Currently, there is no way to make this work since terminal is the only promp driver available. We do not even need a prompt driver for sso sessions...

[spirulence]

Until a fix is available - I have developed a gnarly workaround that can help us folks who are not using MFA yet. You need to fake the availability of an alternate prompt driver and tell aws-vault to use it.

AWS Vault uses the presence of executables in the system path in order to determine which prompt drivers are available. For example, to determine if kdialog is available, this method in prompt/kdialog.go is run:

aws-vault/prompt/kdialog.go

Line 19 in e22aea1

func init() {

func init() {
	if _, err := exec.LookPath("kdialog"); err == nil {
		Methods["kdialog"] = KDialogMfaPrompt
	}
}

exec.LookPath comes from the Go standard library: https://pkg.go.dev/os/exec or https://pkg.go.dev/os/exec#LookPath

It's just looking for an executable with the right name in the system path to determine availability. So in my case, I duplicated a valid system executable, placed it in my user-specific binary directory and gave it the right name for kdialog:

cp /usr/bin/mv $HOME/bin/kdialog

I haven't tried using a shell script instead of a binary - with the appropriate permissions and shebang line it would probably work.

On my system I do have such a directory already added to my PATH. So now, the following works without issue:

aws-vault exec <profile> --server --prompt=kdialog

You could optimize this workaround a little more with two more tricks:

1. use an environment variable for the prompt driver so you don't have to type it every time, AWS_VAULT_PROMPT
2. add an executable to the current directory instead of in a system path: see this note at the bottom of the package docs:

Setting the environment variable GODEBUG=execerrdot=0 disables generation of ErrDot entirely, temporarily restoring the pre-Go 1.19 behavior for programs that are unable to apply more targeted fixes. A future version of Go may remove support for this variable.

Before adding such overrides, make sure you understand the security implications of doing so. See https://go.dev/blog/path-security for more information.