From f7f06d1211455aa5bb6602ccb22320dee9b9b672 Mon Sep 17 00:00:00 2001 From: Trevor Bedford Date: Fri, 23 Oct 2026 14:52:54 -0700 Subject: [PATCH 1/2] authn: Ignore local AWS credentials when authenticating with Cognito The Cognito user pool APIs that CognitoSession uses (InitiateAuth and RespondToAuthChallenge) don't use AWS credentials, but creating the boto3 client still loaded them from local AWS configuration. For a profile using console login credentials (`login_session`, from `aws login`), botocore needs the optional awscrt dependency to do that, so `nextstrain login`, `nextstrain whoami`, and nextstrain.org remote commands failed with a MissingDependencyException when awscrt wasn't installed, as in the standalone bundle. Create the client unsigned so no credentials are loaded, as suggested in the issue. Resolves: Co-Authored-By: Claude Opus 5.5 --- CHANGES.md | 8 ++++++++ doc/changes.md | 9 +++++++++ nextstrain/cli/authn/session.py | 12 +++++++++++- 3 files changed, 28 insertions(+), 1 deletion(-) diff --git a/CHANGES.md b/CHANGES.md index a9b7dda9..d8cd6a8a 100644 --- a/CHANGES.md +++ b/CHANGES.md @@ -13,6 +13,14 @@ development source code and as such may not be routinely kept up to date. # __NEXT__ +## Bug fixes + +* Commands that authenticate with nextstrain.org, such as `nextstrain login`, + `nextstrain whoami`, and `nextstrain remote` with nextstrain.org addresses, + no longer load AWS credentials, which they don't use. Previously, a local + AWS profile using console login credentials (from `aws login`) caused these + commands to fail with an error about a missing `botocore[crt]` dependency. + ([#533](https://github.com/nextstrain/cli/issues/533)) # 11.1.1 (22 October 2026) diff --git a/doc/changes.md b/doc/changes.md index 6bd35ab7..4598273b 100644 --- a/doc/changes.md +++ b/doc/changes.md @@ -16,6 +16,15 @@ development source code and as such may not be routinely kept up to date. (v-next)= ## __NEXT__ +(v-next-bug-fixes)= +### Bug fixes + +* Commands that authenticate with nextstrain.org, such as `nextstrain login`, + `nextstrain whoami`, and `nextstrain remote` with nextstrain.org addresses, + no longer load AWS credentials, which they don't use. Previously, a local + AWS profile using console login credentials (from `aws login`) caused these + commands to fail with an error about a missing `botocore[crt]` dependency. + ([#533](https://github.com/nextstrain/cli/issues/533)) (v11-1-1)= ## 11.1.1 (22 October 2026) diff --git a/nextstrain/cli/authn/session.py b/nextstrain/cli/authn/session.py index f252bc1c..1fdaa620 100644 --- a/nextstrain/cli/authn/session.py +++ b/nextstrain/cli/authn/session.py @@ -7,6 +7,8 @@ import secrets from base64 import b64encode +from botocore import UNSIGNED +from botocore.config import Config from errno import EADDRINUSE from hashlib import sha256 from http.server import ThreadingHTTPServer, BaseHTTPRequestHandler @@ -704,7 +706,15 @@ def __init__(self, origin: Origin): self.user_pool_id = self.client_configuration["aws_cognito_user_pool_id"] self.user_pool_region = self.user_pool_id.split("_")[0] - self.cognito = boto3.client("cognito-idp", region_name = self.user_pool_region) + # Cognito's user pool auth APIs (InitiateAuth, RespondToAuthChallenge) + # don't use AWS credentials, so don't load any. Loading them can fail + # depending on local AWS configuration, e.g. a profile from `aws login` + # when the optional awscrt dependency isn't installed. + # + self.cognito = boto3.client( + "cognito-idp", + region_name = self.user_pool_region, + config = Config(signature_version = UNSIGNED)) self.can_authenticate_with_password = True From 222cfe8079c58f5bfe330927fd2901c2c31f6e48 Mon Sep 17 00:00:00 2001 From: Trevor Bedford Date: Fri, 23 Oct 2026 15:08:23 -0700 Subject: [PATCH 2/2] Add PR link to changelog Co-Authored-By: Claude Opus 5.5 --- CHANGES.md | 2 +- doc/changes.md | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/CHANGES.md b/CHANGES.md index d8cd6a8a..6b6327c1 100644 --- a/CHANGES.md +++ b/CHANGES.md @@ -20,7 +20,7 @@ development source code and as such may not be routinely kept up to date. no longer load AWS credentials, which they don't use. Previously, a local AWS profile using console login credentials (from `aws login`) caused these commands to fail with an error about a missing `botocore[crt]` dependency. - ([#533](https://github.com/nextstrain/cli/issues/533)) + ([#533](https://github.com/nextstrain/cli/issues/533), [#552](https://github.com/nextstrain/cli/pull/552)) # 11.1.1 (22 October 2026) diff --git a/doc/changes.md b/doc/changes.md index 4598273b..01f61c73 100644 --- a/doc/changes.md +++ b/doc/changes.md @@ -24,7 +24,7 @@ development source code and as such may not be routinely kept up to date. no longer load AWS credentials, which they don't use. Previously, a local AWS profile using console login credentials (from `aws login`) caused these commands to fail with an error about a missing `botocore[crt]` dependency. - ([#533](https://github.com/nextstrain/cli/issues/533)) + ([#533](https://github.com/nextstrain/cli/issues/533), [#552](https://github.com/nextstrain/cli/pull/552)) (v11-1-1)= ## 11.1.1 (22 October 2026)