CDK CLI: region must be in `config` file (ignored in `credentials` file) since 2.167.0

[rix0rrr]

Describe the bug

From this thread: #32120

By @otbe:

---

For us the issue is in the region, e.g.

deploy -vvv

10:38:42] Looking up AWS region in the EC2 Instance Metadata Service (IMDS).
[10:38:43] Unable to retrieve AWS region from IMDS: Error: Error fetching metadata token: TimeoutError: Connection timed out after 1000 ms
[10:38:43] Unable to determine AWS region from environment or AWS configuration (profile: "default"), defaulting to 'us-east-1'

Not quite sure how it worked in older aws-cdk versions but the region is specified in .aws/credentials similar to this

[default]
aws_access_key_id=
aws_secret_access_key=
aws_session_token=
aws_security_token=
region=eu-central-1

That means our stacks are deployed in the wrong region with 2.167.0 🫠
Reverting back to 2.166.0 solves the issue.

Regression Issue

• Select this option if this issue appears to be a regression.

Last Known Working CDK Version

No response

Expected Behavior

Uses my configured region in the INI file

Current Behavior

Uses us-east-1

Reproduction Steps

See description

Possible Solution

No response

Additional Information/Context

No response

CDK CLI Version

2.167.0

Framework Version

No response

Node.js Version

OS

Language

TypeScript

Language Version

No response

Other information

No response

[rix0rrr]

If the statement is in the ~/.aws/config file it works, just not when it's in the ~/.aws/credentials file. The SDKv2 treated these files the same, the SDKv3 apparently does not.

Strangely enough the AWS CLI does also seem to support the value in both config files, even though it has been specced to only work in the config file.

Location of [default] region= statement	Works in 2.167.0	Works in AWS CLI
~/.aws/credentials	❌	✅
~/.aws/config	✅	✅

Examples say the region should go into config

All examples of these files also always put keys in credentials and other values in config:

https://docs.aws.amazon.com/cli/v1/userguide/cli-configure-files.html

Documentation say the region flag is only specced for the config file

https://docs.aws.amazon.com/cli/v1/userguide/cli-configure-files.html

aws configure puts region into config

If you run

$ aws configure

And fill in all the values, that command will put the region into the config file, not the credentials file

[otbe]

Interesting findings. What is also somehow strange we have a lot of node scripts with aws sdkv3 running in the same setup (region in /credentials) and they still work fine.

[rix0rrr]

What is also somehow strange we have a lot of node scripts with aws sdkv3 running in the same setup (region in /credentials) and they still work fine.

That is quite weird indeed.

It might be that there's a difference between the code paths that determine a region for the purposes of making an API call, versus the code paths that we use to query the region.

[rix0rrr]

Ah yeah, it's us:

aws-cdk/packages/aws-cdk/lib/api/aws-auth/awscli-compatible.ts

Line 152 in fb97684

return sharedFiles?.configFile?.[profile]?.region || sharedFiles?.configFile?.default?.region;

[otbe]

Just for confirmation: after putting the region into .aws/config everything works again :)

[ashishdhingra]

Labeling the issue as p1 for now since it is being actively worked upon.