Hi there all of a sudden i m getting the following error whe

Question

Hi there all of a sudden i m getting the following error when trying to do a `pulumi up` or `pulumi refresh` using an S3 bucket as my backend ``` error unable to discover AWS AccessKeyID and or SecretAccessKey see for details on configuration``` AFAIK nothing has changed in my `~ aws config` or `~ aws credentials` file I ve also tried specifying a profile as suggested here but i m continuing to bang my head on this problem

billowy-army-68599 · Answer

Does aws sts get caller identity return the account you expect it to

helpful-kitchen-78641 · Answer

yes though i should add that the backend bucket is in one account which is accessible via my `default` profile and the resources it s creating are in another `staging` The `aws profile` specified in my `Pulumi stackname yaml` has permission to create modify those resources

helpful-kitchen-78641 · Answer

the accounts should have cross account access to this bucket and this did work in the past and i m a little lost why i just recently started getting this message

billowy-army-68599 · Answer

something to bear in mind the credential provider for the bucket access and your pulumi program are slightly different i can t help with debugging but bear that in mind

helpful-kitchen-78641 · Answer

any thoughts on how to maybe get some more info I ve tried ` v=3` but it doesn t show anything extra

helpful-kitchen-78641 · Answer

and would `AWS SDK LOAD CONFIG=1` make the credentials provider more similar

helpful-kitchen-78641 · Answer

thanks for that additional info on the credentials provider though it might give me a new wall to bang my head against lol

billowy-army-68599 · Answer

` v=9 logtostderr`

billowy-army-68599 · Answer

< helpful kitchen 78641> the error is coming from the provider

billowy-army-68599 · Answer

not the bucket which is configured in the CLI

billowy-army-68599 · Answer

if you do ```export AWS PROFILE= lt your profile name gt aws sts get caller identity```

billowy-army-68599 · Answer

does it work

billowy-army-68599 · Answer

also are you using aws sso

helpful-kitchen-78641 · Answer

`aws sts get caller identity` appears to work with an appended ` botocore session 16 ` to the account role i would expect to see and we are not using aws sso

helpful-kitchen-78641 · Answer

another interesting thing i just noticed `pulumi preview diff` has no problems