When using AWS login, if you add credential_process to the default profile, you cannot log in, and how to work around it
This page has been translated by machine translation. View original
Introduction
Hello everyone, this is Akaike.
Recently, I had been setting credential_process in the default profile in order to use aws login for Terraform authentication.
However, when trying to run aws login in this state, it was rejected with an error.
This article summarizes the cause and workaround.
- Provider: https://github.com/hashicorp/terraform-provider-aws/issues/45316
- Terraform core (S3 backend): https://github.com/hashicorp/terraform/issues/37976
Using Terraform with aws login
aws login is a command that uses AWS Management Console sign-in credentials to obtain temporary credentials for CLI and SDK use.
It is available with AWS CLI 2.32.0 and later, and upon login, login_session is written to the profile.
[default]
login_session = arn:aws:iam::0123456789012:user/username
region = ap-northeast-1
Next, Terraform's AWS Provider resolves credentials internally using the AWS SDK for Go.
However, when aws login first appeared, the Provider could not recognize this login_session (the setting written by aws login), so the obtained credentials could not be read directly by Terraform.
For this reason, it was common practice at the time to use credential_process to bridge the aws login session to Terraform.
(By specifying aws configure export-credentials in credential_process, every time the Provider requests credentials, the CLI exports and passes temporary credentials from the aws login session.)
The Issue
I had set credential_process in the default profile.
[default]
region = ap-northeast-1
credential_process = aws configure export-credentials --profile default
When running aws login in this state, it fails with the following error.
$ aws login
aws: [ERROR]: An error occurred (Configuration): Profile 'default' is already configured with Credential Process credentials.
You may run 'aws login --profile new-profile-name' to create a new profile with the specified name. Otherwise you must first manually remove the existing credentials from 'default'.
Cause
aws login aborts processing when the target profile already has credential_process (or aws_access_key_id, role_arn, SSO-related settings, etc.) configured, causing the login to fail.
Looking at the AWS CLI source code, it is explained that these existing credentials have higher priority than the login_session written by aws login during resolution.
Note that in this configuration, credential_process references itself with --profile default, meaning that even if login succeeded, resolution would loop. That also needed to be addressed.
Solutions
Option 1: Use the latest version and stop using credential_process (recommended)
As mentioned at the beginning, updates have since been made, and Terraform now natively supports aws login credentials.
However, since the support timing differs between the Provider and the backend, the required version varies depending on the backend you are using.
- AWS Provider: Supports
aws loginfrom v6.23.0 (November 26, 2025) onwards - S3 backend: Terraform core v1.15.0 (April 29, 2026) and later supports
aws login
The S3 backend resolves credentials independently from the Provider (using the SDK built into the terraform binary).
Therefore, the required versions are as follows.
| Backend | Required Version |
|---|---|
| Local | Provider 6.23.0 or later only |
| S3 | Provider 6.23.0 or later AND Terraform 1.15.0 or later |
In either case, credential_process configuration is not needed, and you can use aws login with the login profile.
[default]
region = ap-northeast-1
login_session = arn:aws:iam::0123456789012:user/username # Added after successful aws login
In conclusion, since credential_process is not written at all, the error described here will not occur.
Therefore, it is recommended to first check whether you can upgrade your version.
Option 2: If you cannot upgrade the version, separate the profiles
If you need to continue using an older Provider/Terraform and must use credential_process, you can avoid the error by separating the login profile from the credential_process profile.
The approach is to prepare a dedicated profile for aws login and have the credential_process side reference that profile.
Prepare a dedicated login profile (here called signin) and have the profile using credential_process (such as default) reference it.
[default]
region = ap-northeast-1
credential_process = aws configure export-credentials --profile signin # Set in advance
[profile signin]
region = ap-northeast-1
login_session = arn:aws:iam::0123456789012:user/username # Added after successful aws login
Then, log in using the dedicated login profile (signin).
$ aws login --profile signin
This way, aws login --profile signin succeeds because it is executed against a profile that does not have credential_process.
Also, since default can share the temporary credentials of signin via credential_process, it can also be used by older versions of Terraform or other tools that do not support login_session.
Note that while the aws login token is valid, the signin credentials are used every time credential_process is called, and the CLI automatically refreshes them.
Therefore, once you log in with aws login --profile signin, you can simply run terraform with the default profile afterward.
Conclusion
That covers the issue of being unable to log in when credential_process is set on the default profile while using aws login, along with the workaround.
The root cause of the error was the specification that login_session and credential_process cannot coexist in the same profile.
Also, if you can upgrade your version, the cleanest solution is to stop using credential_process altogether, so please check the version you are using first.
I hope this helps anyone struggling with the same issue.
