From 1c811b80aa9a19a033c019179e51b724940eaa5f Mon Sep 17 00:00:00 2001 From: Alex Castillo Date: Thu, 12 Nov 2026 13:38:53 -0400 Subject: [PATCH] fix(aws): only strip the value that follows --profile stripAndReturnProfileFlag dropped every later argument equal to the profile name, so 'aws --profile alice iam get-user --user-name alice' lost the trailing 'alice'. Skip just the value after --profile. Signed-off-by: Alex Castillo --- plugins/aws/access_key_test.go | 10 ++++++++++ plugins/aws/cli_provisioner.go | 7 +++++-- 2 files changed, 15 insertions(+), 2 deletions(-) diff --git a/plugins/aws/access_key_test.go b/plugins/aws/access_key_test.go index 43ca67205..baea72872 100644 --- a/plugins/aws/access_key_test.go +++ b/plugins/aws/access_key_test.go @@ -742,6 +742,16 @@ func TestStripAndReturnProfileFlag(t *testing.T) { expectedArgs: []string{"--", "wrapped command", "--profile", "dev"}, expectedFlagValue: "", }, + { + args: []string{"iam", "get-user", "--profile", "alice", "--user-name", "alice"}, + expectedArgs: []string{"iam", "get-user", "--user-name", "alice"}, + expectedFlagValue: "alice", + }, + { + args: []string{"iam", "get-user", "--profile=alice", "--user-name", "alice"}, + expectedArgs: []string{"iam", "get-user", "--user-name", "alice"}, + expectedFlagValue: "alice", + }, } { t.Run(fmt.Sprintf("test case %d", i), func(t *testing.T) { flag, args, err := stripAndReturnProfileFlag(scenario.args) diff --git a/plugins/aws/cli_provisioner.go b/plugins/aws/cli_provisioner.go index f8915885a..645ed0b04 100644 --- a/plugins/aws/cli_provisioner.go +++ b/plugins/aws/cli_provisioner.go @@ -29,7 +29,8 @@ func stripAndReturnProfileFlag(args []string) (string, []string, error) { var profileValue string var newArgs []string commandOptionsEnded := false - for i, arg := range args { + for i := 0; i < len(args); i++ { + arg := args[i] // if `--profile` is used after `--`, it should not be interpreted as a flag if arg == "--" { commandOptionsEnded = true @@ -39,12 +40,14 @@ func stripAndReturnProfileFlag(args []string) (string, []string, error) { return "", nil, fmt.Errorf("--profile flag was specified without a value") } profileValue = args[i+1] + // skip the value too, so later arguments equal to the profile name are kept + i++ } else if !commandOptionsEnded && strings.HasPrefix(arg, "--profile=") { profileValue = strings.TrimPrefix(arg, "--profile=") if profileValue == "" { return "", nil, fmt.Errorf("--profile flag was specified without a value") } - } else if commandOptionsEnded || arg != profileValue { + } else { // make sure only profile specification args are removed from the command line so that aws cli does not attempt to assume a role by itself. newArgs = append(newArgs, arg) }