How you might improve the question is a bit of an opinionated question. I can't speak for why people downvoted the question of course. But here's the issues I can see in this question. This is perhaps more detailed than necessary, and I will not argue you need to fix all of these to prevent downvotes, I'm just trying to answer the question "how could this question be better" to what I see with this question. And please don't take this the wrong way, I'm absolutely not trying to belittle your question, just trying to answer what I see as someone that's been around the AWS block a few hundred times.
First off, one issue I have is reading a history of how you got to this solution. It's generally not interesting. It feels to me like searching for a recipe, and getting a story about the author's family the first time they tried the recipe before I see the recipe. Maybe some people like the extra background, but on a site like Stack Overflow, it muddies the water. On Stack Overflow, I want to see questions, and details on what's not working, not much more.
Then there's the code:
You have two large code blocks that are mostly the same. To my mind, showing a history of the code as it evolved doesn't help. It's never a good sign when I need to open a diff tool to understand what's going on in a question. To the contrary, all of this code makes it harder to understand what the question's about. If you do need to point out the added bit in a block of code, a comment like # This is the bit I added that broke foo
is enough. Viewing code history is useful if I'm trying to understand why a line was added, not helpful in understanding what it's doing.
And on that code, there's a lot going on here that has nothing to do with the question. You don't actually tell us where the code is failing. I can infer it from context clues, but questions fare much better if we know exactly where the code is failing.
This shows the second major issue: One of the comments you'll see added to posts a lot is "Please post a minimal reproducible example". This is for two big reasons: It helps anyone trying to answer your question, and more importantly, it helps the question asker! Often the effort of creating a small example to reproduce an example will lead to the discovery of the issue itself. It's a useful debugging technique on its own.
I'd expect this question to be a fairly simple subset of the script that calls aws-adfs
using expect
, and perhaps one line to verify the call worked correctly. Anything else just ends up confusing possible helpers. This is, of course, a bit of an art form. If you had just posted an expect script without clues as to what it's calling, it might not be enough to help you, but at the same time, the code you have below the call to aws sts assume-role
doesn't add anything.
And, on top of all of this, expect
has a fairly rich debug mode. What does that show? I expect (no pun intended) question answers to use debuggers available to them first, and expect
is no different. I very much expect (ok, that one was deliberate) that if you had run your script with expect -d
, you would have seen the core issue here, or at least had something to add to the question that would have no doubt been obvious to anyone familiar with expect
.
Finally, on a technical side, there are a few things that sour me in this post:
- As mentioned in a comment,
aws-adfs
has a supported way to pass credentials in. You're not using them, but unless you tell me why, perhaps unfairly, I'm going to assume the reason is you didn't know about it, which makes me question how much research you did. Not fair, at all, I admit, but it leaves a bad taste.
- Speaking of, manually breaking out the credentials using assume-role like this is odd, to say the least, when AWS cli has a supported way to assume a role without needing to pass around secrets manually.
- The assumption later on that all prefixes in your bucket are 32 characters out in each listing might be fine for your use case, but it's not safe in the general case. It's probably better to use
s3api list-objects
and jq
to parse the return.
Other than the bit about passing in credentials to aws-adfs
, these issues aren't helpful for your question. They just leave a bad taste in my mouth, and I'm less likely to answer questions with piles of messy code, since for better or worse, I've found it leads to a rabbit hole of follow up questions.
ASSUMED_ROLE=
line needed for the example? From what I see it's never reached anyway. And you could try to find out which exact line causes the error.