# Using 'aws login' with Dynamic Inventory plugin: amazon.aws.aws\_ec2

**URL:** <https://forum.ansible.com/t/using-aws-login-with-dynamic-inventory-plugin-amazon-aws-aws-ec2/45744>\
**Category:** Get Help\
**Tags:** ubuntu, aws, inventory\
**Created:** [April 27, 2026, 8:08pm UTC](https://forum.ansible.com/t/using-aws-login-with-dynamic-inventory-plugin-amazon-aws-aws-ec2/45744 "2026-04-27T20:08:07Z")\
**Posts on this page:** 8\
**Page:** 1

<div class="post-metadata">

**Author:** ![adamatrfx](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/adamatrfx/32/9663_2.png) [@adamatrfx](https://forum.ansible.com/u/adamatrfx)\
**Post date:** [April 27, 2026, 8:08pm UTC](https://forum.ansible.com/t/using-aws-login-with-dynamic-inventory-plugin-amazon-aws-aws-ec2/45744/1 "2026-04-27T20:08:07Z")

</div>

I have been using the plugin: amazon.aws.aws\_ec2 successfully for a while now.

I was successfully using aws-azure-login to get my AWS credentials, which works when it works but aws-azure-login doesn’t always work and has consumed many of my hours trying to restore functionality when it stopes working.

Today I tried use the ‘aws login’ which is part of the AWS CLI.  
[Login for AWS local development using console credentials - AWS Command Line Interface](https://docs.aws.amazon.com/cli/latest/userguide/cli-configure-sign-in.html#cli-configure-sign-in-with-profile)

I can log in and use the cli without issue, but the dynamic inventory plugin seems to be unaware of it.

I have tried exporting the variables:  
`eval "$(aws configure export-credentials --profile your-profile-name --format env)"`

which seems to have worked

```auto
echo $AWS_ACCESS_KEY_ID
**************** APD6

```

except that the dynamic library still isn’t working.  
Any thoughts on what I might be missing or how I go about troubleshooting this?

For testing, I am just trying to list a single inventory file:

```auto
ansible-inventory -i honorapp_aws_ec2.yaml --list
[WARNING]: Unable to parse honorapp_aws_ec2.yaml as an inventory source
[WARNING]: No inventory was parsed, only implicit localhost is available
{
    "_meta": {
        "hostvars": {},
        "profile": "inventory_legacy"
    },
    "all": {
        "children": [
            "ungrouped"
        ]
    }
}

```

but I am logged in

```auto
aws configure export-credentials --format env
export AWS_ACCESS_KEY_ID= **************** APD6
export AWS_SECRET_ACCESS_KEY= **************** mRCM
export AWS_SESSION_TOKEN= **************** 8lXIQ=
export AWS_CREDENTIAL_EXPIRATION=2026-04-27T20:43:29+00:00

```

and I can use the CLI without issue.

As a hail mary, I tried grabbing the keys from the environment:

```auto
# The access key for your AWS account.
aws_access_key: "{{ lookup('env', 'AWS_ACCESS_KEY_ID') }}"
# The secret access key for your AWS account.
aws_secret_key: "{{ lookup('env', 'AWS_SECRET_ACCESS_KEY') }}"

```

but with the same inventory result.

I am starting to think that whatever broke my aws-azure-login might have somehow also broken my dynamic inventory, which seems unlikely but …

Please help before I lose what is left of my mind.

---

<div class="post-metadata">

**Author:** ![shertel](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/shertel/32/1241_2.png) [@shertel](https://forum.ansible.com/u/shertel)\
**Post date:** [April 28, 2026, 1:17pm UTC](https://forum.ansible.com/t/using-aws-login-with-dynamic-inventory-plugin-amazon-aws-aws-ec2/45744/2 "2026-04-28T13:17:34Z")

</div>

I’m wondering if the plugin is parsing your inventory at all. Is `INVENTORY_ENABLED` configured? You can check with `ansible-config dump --only-changed`.

If it was an issue with the credentials, I’d expect more specific warnings like:

```auto
[WARNING]: Unexpected error while trying to list ec2 regions: Unable to locate credentials
[WARNING]: Failed to parse inventory with 'ansible_collections.amazon.aws.plugins.inventory.aws_ec2' plugin: Failed to describe instances: Unable to locate credentials

```

If that’s not configured, sharing your inventory file would provide more clues as to what’s happening.

---

<div class="post-metadata">

**Author:** ![adamatrfx](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/adamatrfx/32/9663_2.png) [@adamatrfx](https://forum.ansible.com/u/adamatrfx)\
**Post date:** [April 28, 2026, 1:57pm UTC](https://forum.ansible.com/t/using-aws-login-with-dynamic-inventory-plugin-amazon-aws-aws-ec2/45744/3 "2026-04-28T13:57:53Z")

</div>

You are right that the output I shared wasn’t showing the real issue because I wasn’t pointing at the correct inventory file.

When I run it correctly:  
`[WARNING]: Failed to parse inventory with 'auto' plugin: Couldn't connect to AWS: The source profile "default" must have credentials.`

I have finally found a workable solution to this “issue”, but I am hoping there is a better approach as this doesn’t seem great.

When the new `aws login` feature runs, it does not create or update the file ~/.aws/credentials, and creating that file seems to be the only way to get ansible to understand my aws authentication.

So for now, instead of running `aws login` directly, I am running `aws login --profile aws-login` and then a bash script that uses `aws configure set` to create/update the credentials file.

```auto
CREDS=$(aws configure export-credentials --profile aws-login)

ACCESS_KEY=$(echo "$CREDS" | jq -r '.AccessKeyId')
SECRET_KEY=$(echo "$CREDS" | jq -r '.SecretAccessKey')
SESSION_TOKEN=$(echo "$CREDS" | jq -r '.SessionToken')
EXPIRATION=$(echo "$CREDS" | jq -r '.Expiration')

aws configure set aws_access_key_id "$ACCESS_KEY" --profile default
aws configure set aws_secret_access_key "$SECRET_KEY" --profile default
aws configure set aws_session_token "$SESSION_TOKEN" --profile default
aws configure set aws_expiration "$EXPIRATION" --profile default

```

This seems unnecessarily convoluted, but it is working so I am running with it for now.  
I am also playing with [Sourcing credentials with an external process in the AWS CLI - AWS Command Line Interface](https://docs.aws.amazon.com/cli/latest/userguide/cli-configure-sourcing-external.html) to see if I can figure out how to automatically fire the bash script for default.

I think something like this in `~/.aws/config` should work but so far I am having no luck with it.

```auto
[default]
credential_process = "~/.aws/aws-login-workaround.sh"

```

---

<div class="post-metadata">

**Author:** ![shertel](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/shertel/32/1241_2.png) [@shertel](https://forum.ansible.com/u/shertel)\
**Post date:** [April 28, 2026, 3:03pm UTC](https://forum.ansible.com/t/using-aws-login-with-dynamic-inventory-plugin-amazon-aws-aws-ec2/45744/4 "2026-04-28T15:03:36Z")

</div>

That’s strange, you should be able to use the environment variables as-is. Do you have a [profile](https://docs.ansible.com/projects/ansible/latest/collections/amazon/aws/aws_ec2_inventory.html#parameter-profile) set?

I can reproduce the specific error you’re getting by using `default` as a `source_profile` in the ~/.aws/config:

```yaml
[default]
region = us-east-1

[profile dev]
role_arn = arn:aws:iam:123456789012:role/DevRole
source_profile = default # has no credentials configured

```

```yaml
# aws_ec2.yml
plugin: amazon.aws.aws_ec2
profile: dev

```

If you need to become a role, you can do this without a ~/.aws/config by using [assume\_role\_arn](https://docs.ansible.com/projects/ansible/latest/collections/amazon/aws/aws_ec2_inventory.html#parameter-assume_role_arn).

---

<div class="post-metadata">

**Author:** ![adamatrfx](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/adamatrfx/32/9663_2.png) [@adamatrfx](https://forum.ansible.com/u/adamatrfx)\
**Post date:** [April 28, 2026, 3:50pm UTC](https://forum.ansible.com/t/using-aws-login-with-dynamic-inventory-plugin-amazon-aws-aws-ec2/45744/5 "2026-04-28T15:50:58Z")

</div>

Starting over from scratch to make sure that different authentication attempts aren’t interfering with each other, I renamed my .aws folder to .aws-back.

Then I ran ` aws login`.  
My .aws/config:

```auto
[default]
login_session = arn:aws:sts::402300540126:assumed-role/Admin/awilson@rfx-tech.com
region = us-east-1

```

I tried `ansible-inventory -i inventory/honorapp_aws_ec2.yaml --list`  
and understandably:  
`[WARNING]: Failed to parse inventory with 'auto' plugin: Couldn't connect to AWS: The config profile (the-honor-flight-application) could not be found`

So I copied that profile entry over from my earlier setup into the new config:

```auto
[profile the-honor-flight-application]
output = json
region = us-east-1
source_profile = default
role_arn = arn:aws:iam::340910345491:role/RFX_Admins

```

Which gave me the output:  
`[WARNING]: Failed to parse inventory with 'auto' plugin: Couldn't connect to AWS: The source profile "default" must have credentials.`

So I removed that profile and then ran ` aws login --profile the-honor-flight-application` which allowed me to authenticate and added an entry to my config:

```auto
[profile the-honor-flight-application]
login_session = arn:aws:sts::340910345491:assumed-role/RFX_Admins/awilson@rfx-tech.com
region = us-east-1

```

but running the inventory command gave me `[WARNING]: Failed to parse inventory with 'auto' plugin: Failed to describe instances: Unable to locate credentials`

Removing the new profile created by that login and restoring the old profile with `source_profile = default` and then running my script to create a credentials file restores my ability to list inventory for that profile.

---

<div class="post-metadata">

**Author:** ![adamatrfx](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/adamatrfx/32/9663_2.png) [@adamatrfx](https://forum.ansible.com/u/adamatrfx)\
**Post date:** [April 28, 2026, 3:56pm UTC](https://forum.ansible.com/t/using-aws-login-with-dynamic-inventory-plugin-amazon-aws-aws-ec2/45744/6 "2026-04-28T15:56:53Z")

</div>

> [@shertel](#):
>
> If you need to become a role, you can do this without a ~/.aws/config by using [assume\_role\_arn](https://docs.ansible.com/projects/ansible/latest/collections/amazon/aws/aws_ec2_inventory.html#parameter-assume_role_arn).

I have about 60 profiles, give or take.  
My dynamic inventory starts with:

```auto
plugin: amazon.aws.aws_ec2
aws_profile: the-honor-flight-application

```

I tried swapping the profile with the arn which unfortunately has the same credentials issue. I can see the advantage of not needing the profile to make it work, though, so I am going to look more into incorporating this approach instead.

---

<div class="post-metadata">

**Author:** ![shertel](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/shertel/32/1241_2.png) [@shertel](https://forum.ansible.com/u/shertel)\
**Post date:** [April 29, 2026, 1:41pm UTC](https://forum.ansible.com/t/using-aws-login-with-dynamic-inventory-plugin-amazon-aws-aws-ec2/45744/7 "2026-04-29T13:41:30Z")

</div>

Thanks for the additional info. I’ve been unable to reproduce the issue with when using `aws login` with a normal IAM user. I see you’re using a federated IAM user though, so I wonder if that could be a factor. I’d expect your ~/.aws/config to just work.

I’m really perplexed why the environment variables don’t work (even more so if you’re seeing the same error regarding the source\_profile `default`). If an access key/secret key/session token are provided alongside a profile, you should get an error that conflicting methods of authentication are provided.

Hopefully others with more ideas will chime in. Sorry to be of no help.

---

<div class="post-metadata">

**Author:** ![adamatrfx](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/adamatrfx/32/9663_2.png) [@adamatrfx](https://forum.ansible.com/u/adamatrfx)\
**Post date:** [April 29, 2026, 6:44pm UTC](https://forum.ansible.com/t/using-aws-login-with-dynamic-inventory-plugin-amazon-aws-aws-ec2/45744/8 "2026-04-29T18:44:15Z")

</div>

Thank you so much @shertel for your help. Sometimes just knowing something _should_ work is enough to keep trying until it does.

I tried a few more configurations and seem to have stumbled upon something that works.

I think part of the issue I was having with ansible (and terraform and probably other tools I didn’t try) was the shift in authentication mechanisms without entirely clearing out all other mechanisms.

What I mean is that `aws-azure-login` would create an aws/credentials file but `aws login` doesn’t.

When running things other than aws cli, the credentials file was still being used but was invalid. This was hard to realize because all of the core aws cli functions were using the new method.

I completely removed my .aws folder and started over with just the `aws login` and found this combination worked well:

Start with `aws login --profile aws-login` which automatically creates this in .aws/config.

```auto
[profile aws-login]
login_session = arn:aws:sts::402300540126:assumed-role/Admin/awilson@rfx-tech.com
region = us-east-1

```

Then, manually add this to .aws/config

```auto
[default]
region = us-east-1
credential_process = aws configure export-credentials --profile aws-login --format process

```

All other profiles can still reference the default

```auto
[profile the-honor-flight-application]
source_profile = default

```

This is working for me today.  
If I understand correctly, using default (which just about all my profiles do) causes default to call the aws-login profile and output the expected authentication mechanisms.  
When I try to use aws login for the default profile, things like ansible do not authenticate correctly.