@factiii/stack 0.1.182 → 0.1.184

package/dist/plugins/pipelines/aws/scanfix/credentials.js

@@ -2,15 +2,17 @@
 /**
  * AWS Credential Fixes
  *
- * Handles AWS account setup, credential validation,
- * and region configuration checks.
+ * Handles AWS credential sync, account setup, and validation.
  *
- * The aws-account-not-setup fix auto-bootstraps:
- * 1. Checks if AWS SDK can get caller identity (valid credentials)
- * 2. If not, prompts user to login via `aws configure` (root or admin)
- * 3. Confirms with user before creating IAM admin user
- * 4. Creates IAM user, attaches bootstrap policy, creates access key
- * 5. Auto-configures AWS CLI with new IAM credentials
+ * Order matters — aws-credentials-sync MUST be first:
+ * 1. Sync vault → ~/.aws/credentials (ensure CLI uses the right project's key)
+ * 2. Bootstrap if no credentials exist at all
+ * 3. Region check
+ * 4. Vault has credentials stored
+ * 5. Credentials not expired
+ * 6. Prod provisioning credentials valid
+ *
+ * See .spec/aws-iam.md for the full IAM user model.
  */
 var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
     if (k2 === undefined) k2 = k;
@@ -51,6 +53,16 @@ const fs = __importStar(require("fs"));
 const path = __importStar(require("path"));
 const os = __importStar(require("os"));
 const aws_helpers_js_1 = require("../utils/aws-helpers.js");
+/**
+ * Check if this project uses AWS (shared guard for all credential fixes)
+ */
+async function isAwsProject(config) {
+    if (config.aws)
+        return true;
+    const { extractEnvironments } = await Promise.resolve().then(() => __importStar(require('../../../../utils/config-helpers.js')));
+    const environments = extractEnvironments(config);
+    return Object.values(environments).some((e) => !!e.access_key_id || !!e.config);
+}
 /**
  * Read the bootstrap policy JSON from the policies directory
  */
@@ -191,21 +203,245 @@ async function bootstrapAwsAccount(config) {
         return false;
     }
 }
+/**
+ * Sync ~/.aws/credentials from vault, verifying it matches stack.yml.
+ * Returns true if credentials are synced and valid, false otherwise.
+ */
+async function _syncCredentials(config, rootDir) {
+    const awsConfig = (0, aws_helpers_js_1.getAwsConfig)(config);
+    const configKeyId = awsConfig.accessKeyId;
+    const localKeyId = (0, aws_helpers_js_1.getLocalAccessKeyId)();
+    const region = awsConfig.region || 'us-east-1';
+    if (localKeyId && localKeyId !== configKeyId) {
+        console.log('');
+        console.log('   ============================================================');
+        console.log('   AWS CREDENTIAL MISMATCH');
+        console.log('   ============================================================');
+        console.log('   stack.yml access_key_id:   ' + configKeyId);
+        console.log('   ~/.aws/credentials key:    ' + localKeyId);
+        const identity = await (0, aws_helpers_js_1.getCallerArn)(region);
+        if (identity) {
+            console.log('   Logged in as: ' + identity);
+        }
+        console.log('');
+        console.log('   ~/.aws/credentials has keys from a different project.');
+        console.log('   ============================================================');
+    }
+    // Try to sync from vault
+    if (config.ansible?.vault_path) {
+        try {
+            const { AnsibleVaultSecrets } = await Promise.resolve().then(() => __importStar(require('../../../../utils/ansible-vault-secrets.js')));
+            const vault = new AnsibleVaultSecrets({
+                vault_path: config.ansible.vault_path,
+                vault_password_file: config.ansible.vault_password_file,
+            });
+            const vaultKeyId = await vault.getSecret('AWS_ACCESS_KEY_ID');
+            const vaultSecret = await vault.getSecret('AWS_SECRET_ACCESS_KEY');
+            if (!vaultKeyId || !vaultSecret) {
+                console.log('   AWS credentials not found in vault');
+                return false;
+            }
+            // Verify vault key matches stack.yml
+            if (vaultKeyId !== configKeyId) {
+                const { promptSingleLine } = await Promise.resolve().then(() => __importStar(require('../../../../utils/secret-prompts.js')));
+                console.log('');
+                console.log('   ============================================================');
+                console.log('   VAULT / STACK.YML MISMATCH');
+                console.log('   ============================================================');
+                console.log('   Vault AWS_ACCESS_KEY_ID:    ' + vaultKeyId);
+                console.log('   stack.yml access_key_id:    ' + configKeyId);
+                console.log('   ============================================================');
+                console.log('');
+                console.log('   Which is correct?');
+                console.log('   1) Vault is correct → update stack.yml to match vault');
+                console.log('   2) stack.yml is correct → update vault (you will need the secret key)');
+                console.log('');
+                const choice = await promptSingleLine('   Enter 1 or 2: ');
+                if (choice === '1') {
+                    // Update stack.yml access_key_id to match vault
+                    const stackPath = path.join(rootDir, 'stack.yml');
+                    if (fs.existsSync(stackPath)) {
+                        let content = fs.readFileSync(stackPath, 'utf8');
+                        content = content.replace('access_key_id: ' + configKeyId, 'access_key_id: ' + vaultKeyId);
+                        fs.writeFileSync(stackPath, content, 'utf8');
+                        console.log('   [OK] Updated stack.yml access_key_id to ' + vaultKeyId);
+                        // Now vault matches — write to ~/.aws/credentials
+                        (0, aws_helpers_js_1.writeAwsCredentials)(vaultKeyId, vaultSecret, region);
+                        (0, aws_helpers_js_1.clearClientCache)();
+                        const accountId = await (0, aws_helpers_js_1.getAwsAccountId)(region);
+                        if (accountId) {
+                            const identity = await (0, aws_helpers_js_1.getCallerArn)(region);
+                            console.log('   [OK] Synced ~/.aws/credentials from vault');
+                            console.log('   Logged in as: ' + (identity ?? vaultKeyId));
+                            return true;
+                        }
+                        console.log('   Vault credentials failed to authenticate');
+                        return false;
+                    }
+                    console.log('   stack.yml not found');
+                    return false;
+                }
+                else if (choice === '2') {
+                    // stack.yml is correct — prompt for secret key and store in vault
+                    console.log('');
+                    console.log('   Enter the AWS Secret Access Key for ' + configKeyId + ':');
+                    const newSecret = await promptSingleLine('   AWS Secret Access Key: ', { hidden: true });
+                    if (!newSecret) {
+                        console.log('   Secret Access Key is required.');
+                        return false;
+                    }
+                    const trimmedSecret = newSecret.trim();
+                    // Verify credentials by passing them explicitly to STS (don't rely on file cache)
+                    let verifyId = null;
+                    try {
+                        const { STSClient: STS, GetCallerIdentityCommand: GetId } = await Promise.resolve().then(() => __importStar(require('@aws-sdk/client-sts')));
+                        const sts = new STS({
+                            region,
+                            credentials: {
+                                accessKeyId: configKeyId,
+                                secretAccessKey: trimmedSecret,
+                            },
+                        });
+                        const result = await sts.send(new GetId({}));
+                        verifyId = result.Account ?? null;
+                    }
+                    catch (stsErr) {
+                        const errMsg = stsErr instanceof Error ? stsErr.message : String(stsErr);
+                        console.log('   Credentials invalid — check that the secret key matches ' + configKeyId);
+                        console.log('   AWS error: ' + errMsg);
+                        console.log('   TIP: New IAM keys can take ~10 seconds to propagate. Try again shortly.');
+                        return false;
+                    }
+                    if (!verifyId) {
+                        console.log('   Credentials invalid — no account ID returned');
+                        return false;
+                    }
+                    // Credentials verified — write to ~/.aws/credentials
+                    (0, aws_helpers_js_1.writeAwsCredentials)(configKeyId, trimmedSecret, region);
+                    (0, aws_helpers_js_1.clearClientCache)();
+                    const verifyIdentity = await (0, aws_helpers_js_1.getCallerArn)(region);
+                    console.log('   [OK] Verified: ' + (verifyIdentity ?? configKeyId));
+                    // Store in vault
+                    try {
+                        const r1 = await vault.setSecret('AWS_ACCESS_KEY_ID', configKeyId);
+                        const r2 = await vault.setSecret('AWS_SECRET_ACCESS_KEY', newSecret);
+                        if (r1.success && r2.success) {
+                            console.log('   [OK] Stored credentials in Ansible Vault');
+                            return true;
+                        }
+                        console.log('   Failed to store in vault');
+                        return false;
+                    }
+                    catch (e2) {
+                        console.log('   Error storing in vault: ' + (e2 instanceof Error ? e2.message : String(e2)));
+                        return false;
+                    }
+                }
+                else {
+                    console.log('   Skipped — run npx stack fix again to retry');
+                    return false;
+                }
+            }
+            // Vault matches stack.yml — write to ~/.aws/credentials
+            (0, aws_helpers_js_1.writeAwsCredentials)(vaultKeyId, vaultSecret, region);
+            (0, aws_helpers_js_1.clearClientCache)();
+            // Verify the synced credentials work
+            const accountId = await (0, aws_helpers_js_1.getAwsAccountId)(region);
+            if (!accountId) {
+                console.log('   Synced credentials from vault but they failed to authenticate');
+                console.log('   The credentials may be expired or deactivated in AWS');
+                return false;
+            }
+            const identity = await (0, aws_helpers_js_1.getCallerArn)(region);
+            console.log('   [OK] Synced ~/.aws/credentials from vault');
+            console.log('   Logged in as: ' + (identity ?? vaultKeyId));
+            return true;
+        }
+        catch (e) {
+            console.log('   Error reading vault: ' + (e instanceof Error ? e.message : String(e)));
+            return false;
+        }
+    }
+    // No vault — can't auto-fix
+    console.log('');
+    console.log('   To fix, store the correct credentials in the vault:');
+    console.log('     npx stack deploy --secrets set AWS_ACCESS_KEY_ID');
+    console.log('     npx stack deploy --secrets set AWS_SECRET_ACCESS_KEY');
+    console.log('   Then run: npx stack fix');
+    return false;
+}
+// CRITICAL: aws-credentials-sync MUST be the first fix in this array.
+// It ensures ~/.aws/credentials matches stack.yml before any other AWS operation runs.
+// See .spec/aws-iam.md for why.
 exports.credentialsFixes = [
+    {
+        id: 'aws-credentials-sync',
+        stage: 'dev',
+        severity: 'critical',
+        blocking: true,
+        description: '🔑 AWS credentials out of sync (vault → ~/.aws/credentials)',
+        scan: async function (config, _rootDir) {
+            if (!(await isAwsProject(config)))
+                return false;
+            const awsConfig = (0, aws_helpers_js_1.getAwsConfig)(config);
+            const configKeyId = awsConfig.accessKeyId;
+            if (!configKeyId)
+                return false; // No access_key_id in stack.yml — nothing to sync against
+            // Read what ~/.aws/credentials currently has
+            const localKeyId = (0, aws_helpers_js_1.getLocalAccessKeyId)();
+            // Case 1: ~/.aws/credentials matches stack.yml — already synced
+            if (localKeyId === configKeyId)
+                return false;
+            // Case 2: ~/.aws/credentials is missing or has a different key — needs sync
+            // Check if vault can provide the right credentials
+            if (config.ansible?.vault_path) {
+                try {
+                    const { AnsibleVaultSecrets } = await Promise.resolve().then(() => __importStar(require('../../../../utils/ansible-vault-secrets.js')));
+                    const vault = new AnsibleVaultSecrets({
+                        vault_path: config.ansible.vault_path,
+                        vault_password_file: config.ansible.vault_password_file,
+                    });
+                    const check = await vault.checkSecrets(['AWS_ACCESS_KEY_ID', 'AWS_SECRET_ACCESS_KEY']);
+                    if (check.status?.AWS_ACCESS_KEY_ID && check.status?.AWS_SECRET_ACCESS_KEY) {
+                        // Vault has credentials — we can auto-fix
+                        return true;
+                    }
+                }
+                catch {
+                    // Vault unreadable
+                }
+            }
+            // No vault credentials — still flag if there's a mismatch
+            if (localKeyId && localKeyId !== configKeyId) {
+                return true;
+            }
+            return false;
+        },
+        fix: async function (config, _rootDir) {
+            const result = await _syncCredentials(config, _rootDir);
+            if (!result)
+                (0, aws_helpers_js_1.setCredentialsSyncFailed)();
+            return result;
+        },
+        manualFix: [
+            'AWS credentials in ~/.aws/credentials do not match stack.yml access_key_id.',
+            'The vault is the source of truth — sync by running:',
+            '  npx stack fix --dev',
+            '',
+            'Or update vault credentials manually:',
+            '  npx stack deploy --secrets set AWS_ACCESS_KEY_ID',
+            '  npx stack deploy --secrets set AWS_SECRET_ACCESS_KEY',
+        ].join('\n'),
+    },
     {
         id: 'aws-account-not-setup',
         stage: 'dev',
         severity: 'critical',
         description: '☁️ AWS credentials not configured',
         scan: async (config, _rootDir) => {
+            if (!(await isAwsProject(config)))
+                return false;
             const awsConfig = (0, aws_helpers_js_1.getAwsConfig)(config);
-            if (!awsConfig.accessKeyId && !config.aws) {
-                const { extractEnvironments } = await Promise.resolve().then(() => __importStar(require('../../../../utils/config-helpers.js')));
-                const environments = extractEnvironments(config);
-                const hasAwsEnv = Object.values(environments).some((e) => !!e.access_key_id || !!e.config);
-                if (!hasAwsEnv)
-                    return false;
-            }
             const accountId = await (0, aws_helpers_js_1.getAwsAccountId)(awsConfig.region);
             return !accountId;
         },
@@ -237,10 +473,7 @@ exports.credentialsFixes = [
         severity: 'warning',
         description: '🌍 AWS region not configured in stack.yml',
         scan: async (config, _rootDir) => {
-            const { extractEnvironments } = await Promise.resolve().then(() => __importStar(require('../../../../utils/config-helpers.js')));
-            const environments = extractEnvironments(config);
-            const hasAwsEnv = Object.values(environments).some((e) => !!e.access_key_id || !!e.config);
-            if (!hasAwsEnv && !config.aws)
+            if (!(await isAwsProject(config)))
                 return false;
             const awsConfig = (0, aws_helpers_js_1.getAwsConfig)(config);
             return !awsConfig.region || awsConfig.region === 'us-east-1' && !config.aws?.region;
@@ -280,10 +513,7 @@ exports.credentialsFixes = [
         severity: 'critical',
         description: '🔑 AWS credentials not available (env vars or Ansible Vault)',
         scan: async (config, _rootDir) => {
-            const { extractEnvironments } = await Promise.resolve().then(() => __importStar(require('../../../../utils/config-helpers.js')));
-            const environments = extractEnvironments(config);
-            const hasAwsEnv = Object.values(environments).some((e) => !!e.access_key_id || !!e.config);
-            if (!hasAwsEnv && !config.aws)
+            if (!(await isAwsProject(config)))
                 return false;
             if (process.env.AWS_ACCESS_KEY_ID && process.env.AWS_SECRET_ACCESS_KEY) {
                 return false;
@@ -315,10 +545,10 @@ exports.credentialsFixes = [
                 return false;
             }
             try {
-                // Read from ~/.aws/credentials (set by aws configure)
+                // Read from ~/.aws/credentials (set by aws configure or vault sync)
                 const awsCredsPath = path.join(os.homedir(), '.aws', 'credentials');
                 if (!fs.existsSync(awsCredsPath)) {
-                    console.log('   ~/.aws/credentials not found — run "aws configure" first');
+                    console.log('   ~/.aws/credentials not found — run "npx stack fix --dev" first');
                     return false;
                 }
                 const content = fs.readFileSync(awsCredsPath, 'utf8');
@@ -356,176 +586,11 @@ exports.credentialsFixes = [
             '    export AWS_ACCESS_KEY_ID=AKIA...',
             '    export AWS_SECRET_ACCESS_KEY=...',
             '',
-            '  Option B: AWS CLI + auto-store in vault',
-            '    aws configure    (then run: npx stack fix --secrets)',
-            '',
-            '  Option C: Ansible Vault (manual)',
+            '  Option B: Store in Ansible Vault',
             '    npx stack deploy --secrets set AWS_ACCESS_KEY_ID',
             '    npx stack deploy --secrets set AWS_SECRET_ACCESS_KEY',
         ].join('\n'),
     },
-    {
-        id: 'aws-cli-not-configured-from-vault',
-        stage: 'dev',
-        severity: 'warning',
-        description: '🔐 AWS CLI not configured on dev machine (credentials exist in vault)',
-        scan: async (config, _rootDir) => {
-            // Skip if not using AWS
-            const { extractEnvironments } = await Promise.resolve().then(() => __importStar(require('../../../../utils/config-helpers.js')));
-            const environments = extractEnvironments(config);
-            const hasAwsEnv = Object.values(environments).some((e) => !!e.access_key_id || !!e.config);
-            if (!hasAwsEnv && !config.aws)
-                return false;
-            // Skip if AWS CLI already configured
-            const os = await Promise.resolve().then(() => __importStar(require('os')));
-            const awsCredsPath = path.join(os.homedir(), '.aws', 'credentials');
-            if (fs.existsSync(awsCredsPath)) {
-                // Check if credentials are valid
-                const content = fs.readFileSync(awsCredsPath, 'utf8');
-                if (content.includes('aws_access_key_id')) {
-                    return false; // Already configured
-                }
-            }
-            // Check if credentials exist in vault
-            if (!config.ansible?.vault_path)
-                return false;
-            try {
-                const { AnsibleVaultSecrets } = await Promise.resolve().then(() => __importStar(require('../../../../utils/ansible-vault-secrets.js')));
-                const vault = new AnsibleVaultSecrets({
-                    vault_path: config.ansible.vault_path,
-                    vault_password_file: config.ansible.vault_password_file,
-                });
-                const result = await vault.checkSecrets(['AWS_ACCESS_KEY_ID', 'AWS_SECRET_ACCESS_KEY']);
-                // Flag if credentials exist in vault but not in ~/.aws/credentials
-                return !!(result.status?.AWS_ACCESS_KEY_ID && result.status?.AWS_SECRET_ACCESS_KEY);
-            }
-            catch {
-                return false;
-            }
-        },
-        fix: async (config, _rootDir) => {
-            if (!config.ansible?.vault_path) {
-                console.log('   Ansible Vault not configured');
-                return false;
-            }
-            try {
-                const { AnsibleVaultSecrets } = await Promise.resolve().then(() => __importStar(require('../../../../utils/ansible-vault-secrets.js')));
-                const vault = new AnsibleVaultSecrets({
-                    vault_path: config.ansible.vault_path,
-                    vault_password_file: config.ansible.vault_password_file,
-                });
-                const accessKeyId = await vault.getSecret('AWS_ACCESS_KEY_ID');
-                const secretKey = await vault.getSecret('AWS_SECRET_ACCESS_KEY');
-                if (!accessKeyId || !secretKey) {
-                    console.log('   AWS credentials not found in vault');
-                    return false;
-                }
-                const region = config.aws?.region ?? 'us-east-1';
-                (0, aws_helpers_js_1.writeAwsCredentials)(accessKeyId, secretKey, region);
-                (0, aws_helpers_js_1.clearClientCache)(); // Pick up vault credentials
-                console.log('   ✅ Configured ~/.aws/credentials from Ansible Vault');
-                console.log('   ✅ Configured ~/.aws/config (region: ' + region + ')');
-                return true;
-            }
-            catch (e) {
-                console.log('   Error: ' + (e instanceof Error ? e.message : String(e)));
-                return false;
-            }
-        },
-        manualFix: 'Extract AWS credentials from vault and configure CLI:\n' +
-            '    npx stack fix --dev',
-    },
-    {
-        id: 'aws-credentials-wrong-user',
-        stage: 'dev',
-        severity: 'warning',
-        get description() {
-            const arn = this._callerArn;
-            if (arn) {
-                const userName = arn.split('/').pop() ?? 'unknown';
-                return '🔑 AWS CLI using "' + userName + '" instead of admin user (factiii-admin)';
-            }
-            return '🔑 AWS CLI credentials do not match expected admin user';
-        },
-        scan: async (config, _rootDir) => {
-            // Only check if AWS is configured
-            const { extractEnvironments } = await Promise.resolve().then(() => __importStar(require('../../../../utils/config-helpers.js')));
-            const environments = extractEnvironments(config);
-            const hasAwsEnv = Object.values(environments).some((e) => !!e.access_key_id || !!e.config);
-            if (!hasAwsEnv && !config.aws)
-                return false;
-            const awsConfig = (0, aws_helpers_js_1.getAwsConfig)(config);
-            const accountId = await (0, aws_helpers_js_1.getAwsAccountId)(awsConfig.region);
-            if (!accountId)
-                return false; // No valid creds — handled by other fixes
-            // Get current caller identity
-            const callerArn = await (0, aws_helpers_js_1.getCallerArn)(awsConfig.region);
-            if (!callerArn)
-                return false;
-            // Extract username from ARN: arn:aws:iam::ACCOUNT:user/USERNAME
-            const arnParts = callerArn.split('/');
-            const currentUser = arnParts.length > 1 ? arnParts[arnParts.length - 1] : null;
-            if (!currentUser)
-                return false;
-            // The admin user should be factiii-admin
-            // Project scoped users (factiii-{project}-dev, factiii-{project}-prod) don't have IAM perms
-            if (currentUser === 'factiii-admin')
-                return false; // Correct user
-            // Also allow root account (no user path in ARN)
-            if (callerArn.includes(':root'))
-                return false;
-            // Flag ANY scoped factiii user — they lack IAM permissions and may be from
-            // a different project (e.g., last project's user still loaded in ~/.aws/credentials)
-            if (currentUser.startsWith('factiii-') &&
-                (currentUser.endsWith('-dev') || currentUser.endsWith('-prod'))) {
-                this._callerArn = callerArn;
-                return true;
-            }
-            // Unknown user — don't flag (could be custom setup)
-            return false;
-        },
-        fix: async (config, _rootDir) => {
-            // Try to swap to vault admin credentials
-            if (!config.ansible?.vault_path) {
-                console.log('   No Ansible Vault configured — update ~/.aws/credentials manually');
-                return false;
-            }
-            try {
-                const { AnsibleVaultSecrets } = await Promise.resolve().then(() => __importStar(require('../../../../utils/ansible-vault-secrets.js')));
-                const vault = new AnsibleVaultSecrets({
-                    vault_path: config.ansible.vault_path,
-                    vault_password_file: config.ansible.vault_password_file,
-                });
-                const check = await vault.checkSecrets(['AWS_ACCESS_KEY_ID', 'AWS_SECRET_ACCESS_KEY']);
-                if (!check.status?.AWS_ACCESS_KEY_ID || !check.status?.AWS_SECRET_ACCESS_KEY) {
-                    console.log('   Admin credentials not found in vault');
-                    return false;
-                }
-                const accessKeyId = await vault.getSecret('AWS_ACCESS_KEY_ID');
-                const secretKey = await vault.getSecret('AWS_SECRET_ACCESS_KEY');
-                if (!accessKeyId || !secretKey) {
-                    console.log('   Failed to read credentials from vault');
-                    return false;
-                }
-                const awsConfig = (0, aws_helpers_js_1.getAwsConfig)(config);
-                (0, aws_helpers_js_1.writeAwsCredentials)(accessKeyId, secretKey, awsConfig.region || 'us-east-1');
-                // Clear cached clients so they pick up new credentials
-                (0, aws_helpers_js_1.clearClientCache)();
-                // Verify the swapped credentials are the admin user
-                const newArn = await (0, aws_helpers_js_1.getCallerArn)(awsConfig.region);
-                console.log('   Switched to: ' + (newArn ?? 'vault credentials'));
-                return true;
-            }
-            catch (e) {
-                console.log('   Error: ' + (e instanceof Error ? e.message : String(e)));
-                return false;
-            }
-        },
-        manualFix: 'Update ~/.aws/credentials with admin (factiii-admin) credentials:\n' +
-            '  npx stack deploy --secrets set AWS_ACCESS_KEY_ID\n' +
-            '  npx stack deploy --secrets set AWS_SECRET_ACCESS_KEY\n' +
-            '  Then: npx stack fix --dev',
-    },
     {
         id: 'aws-credentials-invalid',
         stage: 'secrets',
@@ -562,24 +627,21 @@ exports.credentialsFixes = [
         severity: 'critical',
         description: '🔑 AWS credentials not valid for prod provisioning',
         scan: async (config, _rootDir) => {
-            const { extractEnvironments } = await Promise.resolve().then(() => __importStar(require('../../../../utils/config-helpers.js')));
-            const environments = extractEnvironments(config);
-            const hasAwsEnv = Object.values(environments).some((e) => !!e.access_key_id || !!e.config);
-            if (!hasAwsEnv && !config.aws)
+            if (!(await isAwsProject(config)))
                 return false;
             const awsConfig = (0, aws_helpers_js_1.getAwsConfig)(config);
             const accountId = await (0, aws_helpers_js_1.getAwsAccountId)(awsConfig.region);
             if (accountId) {
                 // Credentials work — but check if we're using a scoped user that lacks provisioning perms
-                const callerArn = await (0, aws_helpers_js_1.getCallerArn)(awsConfig.region);
-                if (!callerArn)
-                    return false;
-                const arnParts = callerArn.split('/');
-                const currentUser = arnParts.length > 1 ? arnParts[arnParts.length - 1] : null;
-                if (!currentUser)
+                const callerIdentity = await (0, aws_helpers_js_1.getCallerArn)(awsConfig.region);
+                if (!callerIdentity)
                     return false;
+                // Extract username from formatted string "userName (AKIA...)"
+                const currentUser = callerIdentity.includes(' (')
+                    ? (callerIdentity.split(' (')[0] ?? callerIdentity)
+                    : callerIdentity;
                 // Admin and root are fine for provisioning
-                if (currentUser === 'factiii-admin' || callerArn.includes(':root'))
+                if (currentUser === 'factiii-admin' || callerIdentity.includes(':root'))
                     return false;
                 // Scoped users (factiii-xxx-dev, factiii-xxx-prod) lack VPC/EC2 create permissions
                 if (currentUser.startsWith('factiii-') &&
@@ -671,8 +733,9 @@ exports.credentialsFixes = [
             return true;
         },
         manualFix: 'Configure AWS admin credentials:\n' +
-            '  aws configure  (paste factiii-admin access key + secret)\n' +
-            '  Or restore from vault: npx stack fix --dev',
+            '  npx stack deploy --secrets set AWS_ACCESS_KEY_ID\n' +
+            '  npx stack deploy --secrets set AWS_SECRET_ACCESS_KEY\n' +
+            '  Then: npx stack fix --dev',
     },
 ];
 //# sourceMappingURL=credentials.js.map