Hacktoberfest 2026: the issues maintainers tagged for October, open and beginner-friendly. Browse Hacktoberfest issues

`agentcore dev` container fails with LoginTokenLoadError when using `aws login` credentials

Open Beginner friendly
  • Is something wrong?
#2,606 0 comments 0 reactions 0 assignees View on GitHub

Maintainers usually reply within 1 day

Nobody has claimed this yet.

Assessment

Difficulty
2/5
Estimated time
1-3 hours
Newbie friendliness
80/100
Issue type
Bug
Clarity
Clearly specified
Activity status
Active
Tech stack
aws, docker, typescript
Domain
authentication, cli

Research direction

Start in ContainerDevRunner.run(), where the CLI sets AWS_CONFIG_FILE and AWS_SHARED_CREDENTIALS_FILE on the forwarded container environment. Check whether the container env is built in one place and whether a test already asserts on those forwarded variables. Done when the container receives AWS_LOGIN_CACHE_DIRECTORY pointing at /aws-config/login/cache and a test covers that value.

Written by the indexing model from the issue text.

Description

bug
Description

When running a Container-build agent with agentcore dev using aws login credentials (IAM Identity Center login_session), the agent fails with LoginTokenLoadError on every invocation — even immediately after a successful aws login.

The CLI mounts ~/.aws into the container at /aws-config and sets AWS_CONFIG_FILE=/aws-config/config, but does not set AWS_LOGIN_CACHE_DIRECTORY. The botocore login credential provider ignores AWS_CONFIG_FILE and resolves the token cache path independently via ~/.aws/login/cache, which expands to /home/bedrock_agentcore/.aws/login/cache inside the container — a path that does not exist.

Steps to Reproduce
  1. Authenticate with aws login
  2. Run agentcore dev for a Container-build agent
  3. Invoke the agent
Expected Behavior

The agent resolves AWS credentials successfully using the token cached by aws login, matching the behavior seen in CodeZip-build agents.

Actual Behavior

The agent fails immediately with:

botocore.exceptions.LoginTokenLoadError: Error loading login session token:
Unable to load a existing login session for session
arn:aws:iam::<account>:user/<user>.
Please reauthenticate with 'aws login'.

This happens even when the token is freshly issued and not expired.

CLI Version

1.0.0-rc.5

Operating System

macOS

Additional Context

Root cause: In ContainerDevRunner.run(), the CLI sets:

forwardedEnv.AWS_CONFIG_FILE = "/aws-config/config"
forwardedEnv.AWS_SHARED_CREDENTIALS_FILE = "/aws-config/credentials"

But AWS_LOGIN_CACHE_DIRECTORY is not forwarded. Botocore resolves the login token cache in botocore/utils.py::get_login_token_cache_directory():

def get_login_token_cache_directory():
    if 'AWS_LOGIN_CACHE_DIRECTORY' in os.environ:
        return os.path.expanduser(os.environ['AWS_LOGIN_CACHE_DIRECTORY'])
    else:
        return os.path.expanduser(os.path.join('~', '.aws', 'login', 'cache'))

AWS_CONFIG_FILE has no effect on this path. The token cache is present at /aws-config/login/cache inside the container but the provider looks for it at ~/.aws/login/cache (/home/bedrock_agentcore/.aws/login/cache), which doesn't exist.

Fix: Add one line alongside the existing forwarded env vars:

forwardedEnv.AWS_LOGIN_CACHE_DIRECTORY = "/aws-config/login/cache"

Workaround (entrypoint script):

if [ -n "$AWS_CONFIG_FILE" ]; then
    export AWS_LOGIN_CACHE_DIRECTORY="$(dirname "$AWS_CONFIG_FILE")/login/cache"
fi
Dominant language
TypeScript
Stars
304
Forks
105
Avg merge
16h 14m
Merged PRs (30d)
186

Getting set up

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

More from aws/agentcore-cli

All issues in aws/agentcore-cli

Similar issues

More TypeScript issues

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.