Setting up AWS credentials with serverless framework not working when using SSM integration

[rschpdr]

Hello!

I’m experiencing strange behavior while trying to deploy my lambdas using serverless framework. I’m using SSM integration and auto decryption to setup my environment variables directly in the serverless.yml file, as described here.

Serverless is unable to retrieve the encrypted parameters, according to this log:

Serverless Information ---------------------------------- ############################################################################################
        # Completed after 260777ms
        # 12 promises are in the following states:
        #   resolved: 6
        #   rejected: 2
        #   pending:  4
        ##########################################################################################

And then the build fails with this message:

  Serverless Error ---------------------------------------
 
  AWS provider credentials not found. Learn how to set up AWS provider credentials in our docs here: <http://slss.io/aws-creds-setup>.

This might seem like a serverless issue, but I can confirm this is only happening in CircleCI. I’m able to read the variables locally, and deploying from my machine also works. If I remove the ssm parameters from serverless.yml, it works fine.

This probably has something to do with circleCI not creating a correct ~/.aws/credentials file, because if I explicitly set the provider option in serverless, the error changes to this:

Error: Profile default does not exist

I’m setting AWS credentials this way (the circleCI environment variables are correctly configured):

sls config credentials --provider aws --key $AWS_ACCESS_KEY_ID --secret $AWS_SECRET_KEY

Any clue on this? Am I doing something wrong? Thanks!

[rschpdr]

Just solved this. For future readers: the AWS libraries that serverless depends on to decrypt values from SSM expect the ~/.aws/credentials file to be exactly at ~/.aws/credentials (/home/*your username*/.aws/credentials). Anywhere else and it won’t work. Make sure that if you are using sls config credentials to setup your credentials, you are running it from ~/ (or don’t be lazy like me and properly configure your credentials in CircleCI).

Good luck