Standalone bundle ships botocore 1.43.0 without botocore[crt], breaking login for users with local AWS config

[trvrb]

This was quite challenging to track down. Bug report from Claude.

Summary

The standalone Nextstrain CLI bundle (~/.nextstrain/cli-standalone/) ships botocore-1.43.0 but does not bundle botocore[crt]. Any user who has a login_session entry in their ~/.aws/config (any profile, including [default]) gets a fatal MissingDependencyException from every nextstrain command that resolves AWS credentials — most prominently nextstrain login.

This is invisible to users until either (a) they configure an AWS Identity Center-style login, or (b) their cached nextstrain auth token expires and a refresh is forced through the credential chain.

Environment

• Nextstrain CLI version: 11.0.0 (standalone)
• Install path: ~/.nextstrain/cli-standalone/
• Bundled botocore version: 1.43.0 (~/.nextstrain/cli-standalone/lib/botocore-1.43.0.dist-info)
• OS: macOS 25.0.0 (darwin)

Reproduction

1. Have a ~/.aws/config with login_session in any active profile (in my case [default]):

   [default]
   login_session = arn:aws:iam::<account>:user/<name>
   region = us-east-1

2. Run:

   nextstrain login
   

3. Observe traceback ending in:

   File "botocore.credentials", line 2750, in load
   botocore.exceptions.MissingDependencyException: Missing Dependency: Using the login credential provider requires an additional dependency. You will need to pip install "botocore[crt]" before proceeding.
   

Root cause

In botocore 1.43.0, the new "login" credential provider (LoginCredentialProvider.load() in botocore/credentials.py) raises MissingDependencyException whenever the active profile contains login_session and awscrt is not importable. Relevant source:

def load(self):
    loaded_config = self._load_config()
    profile_config = profiles.get(self._profile_name, {})

    if 'login_session' not in profile_config:
        return None

    if EC is None:
        raise MissingDependencyException(
            msg=\"Using the login credential provider requires an \"
                \"additional dependency. You will need to pip install \"
                \"\\\"botocore[crt]\\\" before proceeding.\"
        )

The standalone bundle's lib/ directory contains botocore but no awscrt package, so EC is None and any boto3 client construction in a session whose active profile has login_session fails fatally.

Why this is surprising / hard to diagnose

• The bug is dormant: users with a valid cached ~/.nextstrain/secrets token never hit it, even after login_session is added to AWS config. It only fires when a credential refresh is forced.
• The error blames pip install \"botocore[crt]\", but for standalone-bundle users pip install has no effect — they don't own the Python environment that owns the failing import.
• nextstrain update cli does not currently fix it, since the latest standalone bundle still has the same issue.

Suggested fix

Bundle awscrt into the standalone distribution, equivalent to building the bundle from botocore[crt] (or boto3[crt]) rather than botocore/boto3 alone. This adds a single Rust-compiled wheel (awscrt, ~3 MiB) to the bundle.

User-side workaround (for the docs, until fix lands)

Either:

• Remove the offending [default] profile from ~/.aws/config (or move login_session into a named non-default profile and rely on AWS_PROFILE to opt in), or
• Install a pip-based nextstrain-cli with pip install \"nextstrain-cli\" \"boto3[crt]\" into a Python environment of your choice.

[victorlin]

Thanks for tracking this down. This affects all installation paths, not just the standalone bundle. I've reproduced locally with the dev env, and the fix is to use boto3[crt] here:

cli/setup.py

Line 119 in 0d20368

"boto3",

[joverlee521]

Looks like the login with console credentials is a relatively new feature that requires boto3 1.41.0. This should be fine with our dependency resolution since we are already using boto3 1.43.0

[victorlin]

An alternative fix is to ignore local AWS credentials during nextstrain login with Cognito, i.e. passing config = botocore.config.Config(signature_version = botocore.UNSIGNED) here:

cli/nextstrain/cli/authn/session.py

Line 707 in 0d20368

self.cognito = boto3.client("cognito-idp", region_name = self.user_pool_region)

[joverlee521]

Yeah, I think local AWS credentials should not interfere with the nextstrain login command.

Separately, if we want to support use of console credentials for aws-batch runtime commands, then we can add the [crt] extra.