This message was deleted.

I found the solution. It seems it's a race condition in some way, where the secretsProvider tries to resolve before the config is set, meaning it doesn't grab the

aws:profile

from the StackSettings. Adding the following to the

createOrSelectStack

forces the stack to use the right profile:

stackSettings: {
   ...
},
envVars: {
    AWS_PROFILE: '{profile-name}'
}