Unable to decrypt file: AssumeRoleTokenProvider session option not set

[Thegaram]

Possible regression in v3.8.0. Since upgrading, I'm unable to decrypt a file using AWS KMS. Verified that this works with v3.7.3.

Failed to get the data key required to decrypt the SOPS file.

Group 0: FAILED
  ****: FAILED
    - | could not load AWS config: assume role with MFA enabled, but
      | AssumeRoleTokenProvider session option not set.

Recovery failed because no master key was able to decrypt the file. In
order for SOPS to recover the file, at least one key has to be successful,
but none were.

[hiddeco]

This is a side-effect from updating to AWS SDK v2. The workaround is to prepare you environment before running a command, for example using a tool like https://github.com/99designs/aws-vault.

Terraform (and some other tools) suffer from the exact same problem, and you can find other information here: https://stackoverflow.com/questions/52432717/terraform-unable-to-assume-roles-with-mfa-enabled

[weiguo-pki]

in kms/keysource.go

	region := matches[1]

	cfg, err := config.LoadDefaultConfig(context.TODO(), func(lo *config.LoadOptions) error {
		// add to be compatible with MFA code input
                if lo.AssumeRoleCredentialOptions == nil {
			lo.AssumeRoleCredentialOptions = func(aro *stscreds.AssumeRoleOptions) {
				aro.TokenProvider = stscreds.StdinTokenProvider
			}
		}

		// Use the credentialsProvider if present, otherwise default to reading credentials
		// from the environment.
		if key.credentialsProvider != nil {
			lo.Credentials = key.credentialsProvider
		}
		if key.AwsProfile != "" {
			lo.SharedConfigProfile = key.AwsProfile
		}

[GreasyAvocado]

I'm having a similar issue.
A file gets properly decrypted with v3.7.x, but not with v3.8.x:

Failed to get the data key required to decrypt the SOPS file.

Group 0: FAILED
  <REDACTED KMS KEY ARN>: FAILED
    - | failed to decrypt sops data key with AWS KMS: operation
      | error KMS: Decrypt, https response error StatusCode: 400,
      | RequestID: <REDACTED REQUEST ID>,
      | IncorrectKeyException: The key ID in the request does not
      | identify a CMK that can perform this operation.

Recovery failed because no master key was able to decrypt the file. In
order for SOPS to recover the file, at least one key has to be successful,
but none were.

It's not AssumeRole or identity related, as described in this issue, but I guess it's in the same area.

Any idea what's wrong here?

[guitarrapc]

Issue happens but move foward to aws-vault + sops fixed issue. thanks @hiddeco