Improve error messages around AWS config

.gitignore

@@ -41,3 +41,5 @@ sdk/python/*.egg-info
 
 
 sdk/python/venv
+go.work
+go.work.sum

provider/configure_test.go

@@ -16,6 +16,7 @@ package provider
 
 import (
 	"context"
+	"os"
 	"strings"
 	"testing"
 	"time"
@@ -117,6 +118,185 @@ func TestCheckConfigFastWithCustomEndpoints(t *testing.T) {
 	require.Truef(t, time0.Add(cutoff).After(time.Now()), "CheckConfig with custom endpoints is taking more than %v", cutoff)
 }
 
+func unsetAWSEnv() {
+	os.Unsetenv("AWS_SECRET_ACCESS_KEY")
+	os.Unsetenv("AWS_SESSION_TOKEN")
+	os.Unsetenv("AWS_DEFAULT_REGION")
+	os.Unsetenv("AWS_PROFILE")
+	os.Unsetenv("AWS_ACCESS_KEY_ID")
+	os.Unsetenv("AWS_SECRET_ACCESS_KEY")
+	os.Unsetenv("AWS_REGION")
+	os.Setenv("AWS_CONFIG_FILE", "non-existent/config.json")
+	os.Setenv("AWS_SHARED_CREDENTIALS_FILE", "non-existent/credentials")
+}
+
+func skipIfNotShort(t *testing.T) {
+	if !testing.Short() {
+		t.Skipf("Skipping test in non-short mode")
+	}
+}
+
+func TestMissingCredentialsErrorMessage(t *testing.T) {
+	skipIfNotShort(t)
+	unsetAWSEnv()
+	// We need to reset the credentialsValidationRun flag to false, since the
+	// previous test might have set it to true.
+	credentialsValidationRun.Store(false)
+	os.Setenv("AWS_SKIP_CREDENTIALS_VALIDATION", "false")
+
+	replaySequence(t, `
+	[{
+		"method": "/pulumirpc.ResourceProvider/CheckConfig",
+		"request": {
+			"urn": "urn:pulumi:dev::aws_no_creds::pulumi:providers:aws::default_6_18_2",
+			"olds": {},
+			"news": {
+				"version": "6.18.2"
+			}
+		},
+		"response": {
+			"inputs": {
+				"skipCredentialsValidation": "false",
+				"skipMetadataApiCheck": "true",
+				"skipRegionValidation": "true",
+				"version": "6.18.2"
+			},
+			"failures": [
+				{
+					"reason": "No valid credential sources found.\nPlease see https://www.pulumi.com/registry/packages/aws/installation-configuration/ for more information about providing credentials.\nNEW: You can use Pulumi ESC to set up dynamic credentials with AWS OIDC to ensure the correct and valid credentials are used.\nLearn more: https://www.pulumi.com/registry/packages/aws/installation-configuration/#dynamically-generate-credentials"
+				}
+			]
+		},
+		"metadata": {
+			"kind": "resource",
+			"mode": "client",
+			"name": "aws"
+		}
+	}]`)
+}
+
+func TestMissingRegionErrorMessage(t *testing.T) {
+	skipIfNotShort(t)
+	unsetAWSEnv()
+	credentialsValidationRun.Store(false)
+	os.Setenv("AWS_ACCESS_KEY_ID", "VALID")
+	os.Setenv("AWS_SECRET_ACCESS_KEY", "VALID")
+	os.Setenv("AWS_SKIP_CREDENTIALS_VALIDATION", "false")
+
+	replaySequence(t, strings.ReplaceAll(`
+	[{
+		"method": "/pulumirpc.ResourceProvider/CheckConfig",
+		"request": {
+			"urn": "urn:pulumi:dev::aws_no_creds::pulumi:providers:aws::default_6_18_2",
+			"olds": {},
+			"news": {
+				"version": "6.18.2"
+			}
+		},
+		"response": {
+			"inputs": {
+				"skipCredentialsValidation": "false",
+				"skipMetadataApiCheck": "true",
+				"skipRegionValidation": "true",
+				"version": "6.18.2"
+			},
+			"failures": [
+				{
+					"reason": "Missing region information\nMake sure you have set your AWS region, e.g. '''pulumi config set aws:region us-west-2'''."
+				}
+			]
+		},
+		"metadata": {
+			"kind": "resource",
+			"mode": "client",
+			"name": "aws"
+		}
+	}]`, "'''", "`"))
+}
+
+func TestInvalidCredentialsErrorMessage(t *testing.T) {
+	skipIfNotShort(t)
+	unsetAWSEnv()
+	credentialsValidationRun.Store(false)
+	os.Setenv("AWS_ACCESS_KEY_ID", "INVALID")
+	os.Setenv("AWS_SECRET_ACCESS_KEY", "INVALID")
+	os.Setenv("AWS_REGION", "us-west-2")
+	os.Setenv("AWS_SKIP_CREDENTIALS_VALIDATION", "false")
+
+	replaySequence(t, `
+	[{
+		"method": "/pulumirpc.ResourceProvider/CheckConfig",
+		"request": {
+			"urn": "urn:pulumi:dev::aws_no_creds::pulumi:providers:aws::default_6_18_2",
+			"olds": {},
+			"news": {
+				"version": "6.18.2"
+			}
+		},
+		"response": {
+			"inputs": {
+				"region": "us-west-2",
+				"skipCredentialsValidation": "false",
+				"skipMetadataApiCheck": "true",
+				"skipRegionValidation": "true",
+				"version": "6.18.2"
+			},
+			"failures": [
+				{
+					"reason": "Invalid credentials configured.\nPlease see https://www.pulumi.com/registry/packages/aws/installation-configuration/ for more information about providing credentials.\nNEW: You can use Pulumi ESC to set up dynamic credentials with AWS OIDC to ensure the correct and valid credentials are used.\nLearn more: https://www.pulumi.com/registry/packages/aws/installation-configuration/#dynamically-generate-credentials"
+				}
+			]
+		},
+		"metadata": {
+			"kind": "resource",
+			"mode": "client",
+			"name": "aws"
+		}
+	}]`)
+}
+
+func TestOtherFailureErrorMessage(t *testing.T) {
+	skipIfNotShort(t)
+	unsetAWSEnv()
+	credentialsValidationRun.Store(false)
+	os.Setenv("AWS_ACCESS_KEY_ID", "INVALID")
+	os.Setenv("AWS_SECRET_ACCESS_KEY", "INVALID")
+	os.Setenv("AWS_REGION", "us-west-2")
+	os.Setenv("AWS_PROFILE", "non-existent-profile")
+	os.Setenv("AWS_SKIP_CREDENTIALS_VALIDATION", "false")
+
+	replaySequence(t, `
+	[{
+		"method": "/pulumirpc.ResourceProvider/CheckConfig",
+		"request": {
+			"urn": "urn:pulumi:dev::aws_no_creds::pulumi:providers:aws::default_6_18_2",
+			"olds": {},
+			"news": {
+				"version": "6.18.2"
+			}
+		},
+		"response": {
+			"inputs": {
+				"region": "us-west-2",
+				"skipCredentialsValidation": "false",
+				"skipMetadataApiCheck": "true",
+				"skipRegionValidation": "true",
+				"version": "6.18.2"
+			},
+			"failures": [
+				{
+					"reason": "unable to validate AWS credentials.\nDetails: loading configuration: failed to get shared config profile, non-existent-profile\n"
+				}
+			]
+		},
+		"metadata": {
+			"kind": "resource",
+			"mode": "client",
+			"name": "aws"
+		}
+	}]`)
+}
+
 func replaySequence(t *testing.T, sequence string) {
 	info := *Provider()
 	ctx := context.Background()
@@ -135,3 +315,6 @@ func replaySequence(t *testing.T, sequence string) {
 func init() {
 	version.Version = "6.0.0"
 }
+
+func TestMain(m *testing.M) {
+}

provider/errors/expired_sso.txt

@@ -0,0 +1,4 @@
+Failed to refresh cached SSO credentials.
+Please refresh SSO login.
+NEW: You can use Pulumi ESC to set up dynamic credentials with AWS OIDC to ensure the correct and valid credentials are used.
+Learn more: https://www.pulumi.com/registry/packages/aws/installation-configuration/#dynamically-generate-credentials

provider/errors/invalid_credentials.txt

@@ -0,0 +1,4 @@
+Invalid credentials configured.
+Please see https://www.pulumi.com/registry/packages/aws/installation-configuration/ for more information about providing credentials.
+NEW: You can use Pulumi ESC to set up dynamic credentials with AWS OIDC to ensure the correct and valid credentials are used.
+Learn more: https://www.pulumi.com/registry/packages/aws/installation-configuration/#dynamically-generate-credentials

provider/errors/no_credentials.txt

@@ -0,0 +1,4 @@
+No valid credential sources found.
+Please see https://www.pulumi.com/registry/packages/aws/installation-configuration/ for more information about providing credentials.
+NEW: You can use Pulumi ESC to set up dynamic credentials with AWS OIDC to ensure the correct and valid credentials are used.
+Learn more: https://www.pulumi.com/registry/packages/aws/installation-configuration/#dynamically-generate-credentials

provider/errors/no_region.txt

@@ -0,0 +1,2 @@
+Missing region information
+Make sure you have set your AWS region, e.g. `pulumi config set aws:region us-west-2`.

provider/provider_test.go

@@ -31,11 +31,15 @@ func providerServer(t *testing.T) pulumirpc.ResourceProviderServer {
 	return p
 }
 
-func test(t *testing.T, dir string, opts ...providertest.Option) {
+func skipIfShort(t *testing.T) {
 	if testing.Short() {
 		t.Skipf("Skipping in testing.Short() mode, assuming this is a CI run without AWS creds")
 		return
 	}
+}
+
+func test(t *testing.T, dir string, opts ...providertest.Option) {
+	skipIfShort(t)
 	opts = append(opts,
 		providertest.WithProviderName("aws"),
 		providertest.WithBaselineVersion("5.42.0"),

provider/resources.go

@@ -562,6 +562,18 @@ func durationFromConfig(vars resource.PropertyMap, prop resource.PropertyKey) (*
 	return nil, nil
 }
 
+//go:embed errors/no_credentials.txt
+var noCredentialsError string
+
+//go:embed errors/invalid_credentials.txt
+var invalidCredentialsError string
+
+//go:embed errors/no_region.txt
+var noRegionError string
+
+//go:embed errors/expired_sso.txt
+var expiredSSOError string
+
 func validateCredentials(vars resource.PropertyMap, c shim.ResourceConfig) error {
 	config := &awsbase.Config{
 		AccessKey: stringValue(vars, "accessKey", []string{"AWS_ACCESS_KEY_ID"}),
@@ -662,13 +674,58 @@ func validateCredentials(vars resource.PropertyMap, c shim.ResourceConfig) error
 	config.SharedConfigFiles = []string{configPath}
 
 	if _, _, diag := awsbase.GetAwsConfig(context.Background(), config); diag != nil && diag.HasError() {
-		return fmt.Errorf("unable to validate AWS credentials. \n"+
-			"Details: %s\n"+
-			"Make sure you have set your AWS region, e.g. `pulumi config set aws:region us-west-2`. \n\n"+
-			"NEW: You can use Pulumi ESC to set up dynamic credentials with AWS OIDC to ensure the "+
-			"correct and valid credentials are used.\nLearn more: "+
-			"https://www.pulumi.com/registry/packages/aws/installation-configuration/#dynamically-generate-credentials",
-			formatDiags(diag))
+		formattedDiag := formatDiags(diag)
+		// Normally it'd query sts.REGION.amazonaws.com
+		// but if we query sts..amazonaws.com, then we don't have a region.
+		if strings.Contains(formattedDiag, "dial tcp: lookup sts..amazonaws.com: no such host") {
+			return tfbridge.CheckFailureError{
+				Failures: []tfbridge.CheckFailureErrorElement{
+					{
+						Reason:   noRegionError,
+						Property: "",
+					},
+				},
+			}
+		}
+		if strings.Contains(formattedDiag, "no EC2 IMDS role found") {
+			return tfbridge.CheckFailureError{
+				Failures: []tfbridge.CheckFailureErrorElement{
+					{
+						Reason:   noCredentialsError,
+						Property: "",
+					},
+				},
+			}
+		}
+		if strings.Contains(formattedDiag, "The security token included in the request is invalid") {
+			return tfbridge.CheckFailureError{
+				Failures: []tfbridge.CheckFailureErrorElement{
+					{
+						Reason:   invalidCredentialsError,
+						Property: "",
+					},
+				},
+			}
+		}
+		if strings.Contains(formattedDiag, "failed to refresh cached credentials") {
+			return tfbridge.CheckFailureError{
+				Failures: []tfbridge.CheckFailureErrorElement{
+					{
+						Reason:   expiredSSOError,
+						Property: "",
+					},
+				},
+			}
+		}
+
+		return tfbridge.CheckFailureError{
+			Failures: []tfbridge.CheckFailureErrorElement{
+				{
+					Reason:   fmt.Sprintf("unable to validate AWS credentials.\nDetails: %s\n", formattedDiag),
+					Property: "",
+				},
+			},
+		}
 	}
 
 	return nil