login_session credentials ignore the profile's region; SigninClient falls back to the default profile

[sergiyvamz]

Describe the bug

When credentials are resolved from a named profile that authenticates via a login_session entry, the AWS Sign-In exchange fails to find a region even though the selected profile has region set. The region resolution falls back to the DefaultAwsRegionProviderChain, whose AwsProfileRegionProvider reads the process-default profile (AWS_PROFILE env / aws.profile, else literal default) rather than the profile the credentials provider was configured with.

Credentials themselves resolve from the correct profile — only the region step for the signin call is wrong.

Expected behavior

Resolving login_session credentials from profile X should use profile X's region (and/or the profile name/file in scope) for the SigninClient, so it works without requiring a [default] profile or a process-global AWS_REGION/AWS_PROFILE.

Current behavior

software.amazon.awssdk.core.exception.SdkClientException: Unable to load credentials from any of the providers in the chain AwsCredentialsProviderChain(...):
  [...,
   ProfileCredentialsProvider(profileName=my-profile, profileFile=ProfileFile(...)):
     Unable to load region from any of the providers in the chain
     software.amazon.awssdk.regions.providers.DefaultAwsRegionProviderChain:
       [SystemSettingsRegionProvider: Unable to load region from system settings ...,
        AwsProfileRegionProvider: No region provided in profile: default,
        InstanceProfileRegionProvider: Unable to contact EC2 metadata service.]]

Note No region provided in profile: default while credentials came from profileName=my-profile, and my-profile does have region set.

Steps to reproduce

1. In ~/.aws/config, create a named profile (no [default] present) that uses login_session and has region set:
   [profile my-profile]

login_session = <session>
region = us-west-2

2. Add software.amazon.awssdk:signin to the classpath.
   Resolve credentials scoped to that profile, e.g.:

AwsCredentialsProvider provider = DefaultCredentialsProvider.builder()
    .profileName("my-profile")
    .build();
provider.resolveCredentials();   // triggers the signin exchange

Ensure AWS_REGION/aws.region and AWS_PROFILE/aws.profile are unset. Resolution fails with the error above.

Root cause

LoginProfileCredentialsProviderFactory (LoginProfileCredentialsProviderFactory.java) has the Profile in hand but builds the signin client with default configuration:

Profile profile = credentialsContext.profile();
String loginSession = profile.property(ProfileProperty.LOGIN_SESSION)
                             .orElseThrow(() -> new IllegalArgumentException("login_session property is required"));

this.signinClient = SigninClient.create();   // no region; profile's region/name are dropped
this.credentialsProvider = LoginCredentialsProvider.builder()
    .loginSession(loginSession)
    .signinClient(signinClient)
    .sourceChain(credentialsContext.sourceChain())
    .build();

SigninClient.create() triggers the client's default region resolution, i.e. the no-arg DefaultAwsRegionProviderChain() → new AwsProfileRegionProvider(), whose profile name defaults to ProfileFileSystemSetting.AWS_PROFILE.getStringValueOrThrow() (→ default). The profile object here already carries ProfileProperty.REGION, but it is never read, and the profile name/file from the credentials context is never propagated to region resolution.

The region-provider classes themselves are fine: AwsProfileRegionProvider(Supplier<ProfileFile>, String profileName) and DefaultAwsRegionProviderChain.builder().profileFile(...).profileName(...) both honor a specified profile. The gap is purely that this factory doesn't pass the profile through.

Suggested fix

Configure the signin client's region from the profile (analogous to how the SSO factory reads sso_region):

SigninClient.Builder builder = SigninClient.builder();
profile.property(ProfileProperty.REGION)
       .map(Region::of)
       .ifPresent(builder::region);
this.signinClient = builder.build();

Alternatively (or additionally), propagate profileFile/profileName from ProfileProviderCredentialsContext into the client's region resolution via DefaultAwsRegionProviderChain.builder().profileFile(...).profileName(...), so a custom profile file is also honored.

Workarounds

• Add a [default] profile with the same region (global side effect on every other CLI/SDK call).
• Set AWS_REGION (or AWS_PROFILE) as a process env var (global; can't be scoped per-provider when multiple profiles are used in one JVM).

Regression Issue

• Select this option if this issue appears to be a regression.

Possible Solution

No response

Additional Information/Context

Suggested fix

Configure the signin client's region from the profile (analogous to how the SSO factory reads sso_region):

SigninClient.Builder builder = SigninClient.builder();
profile.property(ProfileProperty.REGION)
       .map(Region::of)
       .ifPresent(builder::region);
this.signinClient = builder.build();

Alternatively (or additionally), propagate profileFile/profileName from ProfileProviderCredentialsContext into the client's region resolution via DefaultAwsRegionProviderChain.builder().profileFile(...).profileName(...), so a custom profile file is also honored.

AWS Java SDK version used

software.amazon.awssdk:signin: 2.46.x (repro observed at 2.46.7 and 2.46.10)

JDK version used

Java_Corretto_jdk/8.502.07-1/x64

Operating System and version

amazoncorretto:8-alpine

[bhoradc]

Hi @sergiyvamz - Thanks for reporting the issue. We'll look into this further and get back to you.