aws-cdk/aws-cognito-identitypool-alpha: allow session tagging

[lobanov]

Describe the feature

Allow IAM roles created by Identity Pool CDK construct to tag sessions for federated identities.

Use Case

We are using a Cognito Identity Pool to assign AWS credentials for federated identities, and we need to tag sessions for the IAM policies to work. Unfortunately, it seems to be impossible to create Identity Pool and its authenticated role in such a way that it is allowed to tag sessions. The approach introduced in #15908 (calling .withSessionTags() on the principal before passing it into the newly created IAM role) seemingly cannot be used with Identity Pool CDK construct, because the identity pool does not exist at the time authenticated role is created, and it looks impossible to change trust policy on the IAM role created by Identity Pool CDK construct itself.

Proposed Solution

It would be great if there was a flag in the Identity Pool CDK construct allowing the authenticated role to tag created sessions. Probably all it needs to do is to call .withSessionTags() on the identity pool principal when the role is being created.

Other Information

As a workaround, we have to manually add sts:TagSessions action to the trust policy of the authenticated role.

Acknowledgements

• I may be able to implement this feature request
• This feature might incur a breaking change

CDK version used

2.130 (python)

Environment details (OS name and version, etc.)

Linux 6.6.30-0-virt 1-Alpine SMP aarch64 GNU/Linux

[pahud]

Yes, adding sts:TagSessions should be a workaround but we definitely need to improve the user experience here. Please help us prioritize with 👍 .