From 63583d8c2fe0050cb27c5a34e277510d268e2a58 Mon Sep 17 00:00:00 2001 From: Stuart Rowlands Date: Sat, 31 Oct 2026 09:01:21 +1000 Subject: [PATCH] fix(ssh): pass the task region explicitly to aws ecs execute-command qc ssh set only AWS_DEFAULT_REGION. AWS CLI v2 gives AWS_REGION precedence, so a shell with AWS_REGION set to another region sent ExecuteCommand there. The org-scoped exec policy then denied it with 'on resource: *'. Pass --region and set AWS_REGION as well. --- src/commands/ssh.ts | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/src/commands/ssh.ts b/src/commands/ssh.ts index 2107068..34e7ad0 100644 --- a/src/commands/ssh.ts +++ b/src/commands/ssh.ts @@ -192,12 +192,15 @@ async function executeAWSCommand( return; } + // The task's region must win over AWS_REGION or a profile region in the user's shell. + const region = sshAccess.region || 'us-east-1'; const env = { ...process.env, AWS_ACCESS_KEY_ID: sshAccess.credentials.accessKeyId || '', AWS_SECRET_ACCESS_KEY: sshAccess.credentials.secretAccessKey || '', AWS_SESSION_TOKEN: sshAccess.credentials.sessionToken || '', - AWS_DEFAULT_REGION: sshAccess.region || 'us-east-1' + AWS_REGION: region, + AWS_DEFAULT_REGION: region }; // Logic: @@ -219,6 +222,7 @@ async function executeAWSCommand( const args = [ 'ecs', 'execute-command', + '--region', region, '--cluster', sshAccess.clusterName || '', '--task', sshAccess.taskArn || '', '--container', containerName,