Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Support managed session policies for assume_role configuration #11

Closed
timoguin opened this issue Aug 27, 2019 · 2 comments · Fixed by #39
Closed

Support managed session policies for assume_role configuration #11

timoguin opened this issue Aug 27, 2019 · 2 comments · Fixed by #39
Assignees
@bflad
Labels
enhancement New feature or request
Milestone
v0.5.0

Comments

@timoguin
Copy link

timoguin commented Aug 27, 2019 •
edited
Loading

Allow scoping down IAM role permissions using managed IAM policies. In addition to the STS Policy parameter, there is now a PolicyArns parameter that allows passing up to 10 managed policies for the session.

There are a lot of benefits to this approach over passing the policy as a JSON string. I've highlighted a few reasons in the linked issue for the Terraform S3 backend.

References:
This was referenced Aug 27, 2019
Closed
Closed
@timoguin
Copy link
Author

Unfortunately, this isn't supported yet by the AWS Go SDK. I created an issue: aws/aws-sdk-go#2794.

@timoguin
Copy link
Author

I've closed out the related issue with the AWS Go SDK: aws/aws-sdk-go#2794. I was mistaken, and support is already available via input types for the assume role functions. Each of the following input types has a PolicyArns argument that's a list of PolicyDescriptorType objects:

  • AssumeRoleInput
  • AssumeRoleWithSAMLInput
  • AssumeRoleWithWebIdentityInput
  • GetFederationTokenInput

@timoguin timoguin mentioned this issue Sep 10, 2019
Closed
@bflad bflad added the enhancement New feature or request label May 28, 2020
@bflad bflad self-assigned this May 28, 2020
@bflad bflad added this to the v0.6.0 milestone May 28, 2020
bflad added a commit that referenced this issue Jun 2, 2020
@bflad
Implement assume role duration, policy ARNs, tags, and transitive tag…
6773451 
… keys support

Reference: #11
Reference: #21
Reference: #34
@bflad bflad mentioned this issue Jun 2, 2020
Merged
bflad added a commit that referenced this issue Jun 3, 2020
@bflad
Implement assume role duration, policy ARNs, tags, and transitive tag…
67ffd6f 
… keys support

Reference: #11
Reference: #21
Reference: #34
@bflad bflad closed this as completed in #39 Jun 3, 2020
bflad added a commit that referenced this issue Jun 3, 2020
@bflad
Implement configuration assume role duration, policy ARNs, tags, and …
5659c74 
…transitive tag keys (#39)

* deps: Update github.com/aws/aws-sdk-go@v1.31.9

To ensure we have all the latest and greatest STS features and prevent any confusion over the AWS Go SDK version minimum in this libary.

Updated via:

```
go get github.com/aws/aws-sdk-go@v1.31.9
go mod tidy
```

* Implement assume role duration, policy ARNs, tags, and transitive tag keys support

Reference: #11
Reference: #21
Reference: #34

* mock: Support EC2 Instance Metadata Service v2 /api/token endpoint

Otherwise, the updated AWS Go SDK EC2 Metadata client would return errors against the mock server.

```
=== RUN   TestGetSession/EC2_metadata_access_key
2020/06/02 19:07:53 [INFO] Attempting to use session-derived credentials
2020/06/02 19:07:53 [INFO] Setting custom EC2 metadata endpoint: http://127.0.0.1:60498/latest
2020/06/02 19:07:53 [DEBUG] Mock EC2 metadata server received request: /latest/api/token
2020/06/02 19:07:53 [DEBUG] Mock EC2 metadata server received request: /latest/api/token
2020/06/02 19:07:53 [DEBUG] Mock EC2 metadata server received request: /latest/api/token
2020/06/02 19:07:53 [INFO] Attempting to use metadata-derived credentials
2020/06/02 19:07:53 [INFO] Setting AWS metadata API timeout to 100ms
2020/06/02 19:07:53 [INFO] Setting custom metadata endpoint: "http://127.0.0.1:60498/latest"
2020/06/02 19:07:53 [DEBUG] Mock EC2 metadata server received request: /latest/api/token
2020/06/02 19:07:53 [DEBUG] Mock EC2 metadata server received request: /latest/api/token
2020/06/02 19:07:53 [DEBUG] Mock EC2 metadata server received request: /latest/api/token
2020/06/02 19:07:53 [DEBUG] Mock EC2 metadata server received request: /latest/api/token
2020/06/02 19:07:53 [INFO] Ignoring AWS metadata API endpoint at http://127.0.0.1:60498/latest as it doesn't return any instance-id
    TestGetSession/EC2_metadata_access_key: session_test.go:1013: expected no error, got error: No valid credential sources found for AWS Provider.
        	Please see https://terraform.io/docs/providers/aws/index.html for more information on
        	providing credentials for the AWS Provider
```
PhillipGameDev added a commit to PhillipGameDev/AWS-SDK-GO-BACKEND that referenced this issue Dec 10, 2024
@PhillipGameDev
Implement configuration assume role duration, policy ARNs, tags, and …
70913a8 
…transitive tag keys (#39)

* deps: Update github.com/aws/aws-sdk-go@v1.31.9

To ensure we have all the latest and greatest STS features and prevent any confusion over the AWS Go SDK version minimum in this libary.

Updated via:

```
go get github.com/aws/aws-sdk-go@v1.31.9
go mod tidy
```

* Implement assume role duration, policy ARNs, tags, and transitive tag keys support

Reference: hashicorp/aws-sdk-go-base#11
Reference: hashicorp/aws-sdk-go-base#21
Reference: hashicorp/aws-sdk-go-base#34

* mock: Support EC2 Instance Metadata Service v2 /api/token endpoint

Otherwise, the updated AWS Go SDK EC2 Metadata client would return errors against the mock server.

```
=== RUN   TestGetSession/EC2_metadata_access_key
2020/06/02 19:07:53 [INFO] Attempting to use session-derived credentials
2020/06/02 19:07:53 [INFO] Setting custom EC2 metadata endpoint: http://127.0.0.1:60498/latest
2020/06/02 19:07:53 [DEBUG] Mock EC2 metadata server received request: /latest/api/token
2020/06/02 19:07:53 [DEBUG] Mock EC2 metadata server received request: /latest/api/token
2020/06/02 19:07:53 [DEBUG] Mock EC2 metadata server received request: /latest/api/token
2020/06/02 19:07:53 [INFO] Attempting to use metadata-derived credentials
2020/06/02 19:07:53 [INFO] Setting AWS metadata API timeout to 100ms
2020/06/02 19:07:53 [INFO] Setting custom metadata endpoint: "http://127.0.0.1:60498/latest"
2020/06/02 19:07:53 [DEBUG] Mock EC2 metadata server received request: /latest/api/token
2020/06/02 19:07:53 [DEBUG] Mock EC2 metadata server received request: /latest/api/token
2020/06/02 19:07:53 [DEBUG] Mock EC2 metadata server received request: /latest/api/token
2020/06/02 19:07:53 [DEBUG] Mock EC2 metadata server received request: /latest/api/token
2020/06/02 19:07:53 [INFO] Ignoring AWS metadata API endpoint at http://127.0.0.1:60498/latest as it doesn't return any instance-id
    TestGetSession/EC2_metadata_access_key: session_test.go:1013: expected no error, got error: No valid credential sources found for AWS Provider.
        	Please see https://terraform.io/docs/providers/aws/index.html for more information on
        	providing credentials for the AWS Provider
```
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees

@bflad bflad

Labels
enhancement New feature or request
Projects
None yet
Milestone
v0.5.0
2 participants
@bflad @timoguin