Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Add AWS Session Tags & Transitive keys #21

Closed
robh007 opened this issue Mar 4, 2020 · 1 comment · Fixed by #39
Closed

Add AWS Session Tags & Transitive keys #21

robh007 opened this issue Mar 4, 2020 · 1 comment · Fixed by #39
Assignees
@bflad
Labels
enhancement New feature or request
Milestone
v0.5.0

Comments

@robh007
Copy link

robh007 commented Mar 4, 2020 •
edited
Loading

You can now use the following arguments Tags & Transitive Tag keys when assuming a role. This allows IAM policies to use these session keys and tags in policy conditions. There's an open issue to add these to the terraform AWS provider, but I don't think that can be done until the config struct is updated within this project.

Session tags & Transitive Tag Keys documentation
https://docs.aws.amazon.com/IAM/latest/UserGuide/id_session-tags.html#id_session-tags_role-chaining
@bflad bflad added the enhancement New feature or request label May 28, 2020
@bflad bflad added this to the v0.6.0 milestone May 28, 2020
@bflad
Copy link
Contributor

bflad commented May 28, 2020

I will try looking into this as part of some other work happening in this library. 👍

@bflad bflad self-assigned this May 28, 2020
bflad added a commit that referenced this issue Jun 2, 2020
@bflad
Implement assume role duration, policy ARNs, tags, and transitive tag…
6773451 
… keys support

Reference: #11
Reference: #21
Reference: #34
@bflad bflad mentioned this issue Jun 2, 2020
Merged
bflad added a commit that referenced this issue Jun 3, 2020
@bflad
Implement assume role duration, policy ARNs, tags, and transitive tag…
67ffd6f 
… keys support

Reference: #11
Reference: #21
Reference: #34
@bflad bflad closed this as completed in #39 Jun 3, 2020
bflad added a commit that referenced this issue Jun 3, 2020
@bflad
Implement configuration assume role duration, policy ARNs, tags, and …
5659c74 
…transitive tag keys (#39)

* deps: Update github.com/aws/aws-sdk-go@v1.31.9

To ensure we have all the latest and greatest STS features and prevent any confusion over the AWS Go SDK version minimum in this libary.

Updated via:

```
go get github.com/aws/aws-sdk-go@v1.31.9
go mod tidy
```

* Implement assume role duration, policy ARNs, tags, and transitive tag keys support

Reference: #11
Reference: #21
Reference: #34

* mock: Support EC2 Instance Metadata Service v2 /api/token endpoint

Otherwise, the updated AWS Go SDK EC2 Metadata client would return errors against the mock server.

```
=== RUN   TestGetSession/EC2_metadata_access_key
2020/06/02 19:07:53 [INFO] Attempting to use session-derived credentials
2020/06/02 19:07:53 [INFO] Setting custom EC2 metadata endpoint: http://127.0.0.1:60498/latest
2020/06/02 19:07:53 [DEBUG] Mock EC2 metadata server received request: /latest/api/token
2020/06/02 19:07:53 [DEBUG] Mock EC2 metadata server received request: /latest/api/token
2020/06/02 19:07:53 [DEBUG] Mock EC2 metadata server received request: /latest/api/token
2020/06/02 19:07:53 [INFO] Attempting to use metadata-derived credentials
2020/06/02 19:07:53 [INFO] Setting AWS metadata API timeout to 100ms
2020/06/02 19:07:53 [INFO] Setting custom metadata endpoint: "http://127.0.0.1:60498/latest"
2020/06/02 19:07:53 [DEBUG] Mock EC2 metadata server received request: /latest/api/token
2020/06/02 19:07:53 [DEBUG] Mock EC2 metadata server received request: /latest/api/token
2020/06/02 19:07:53 [DEBUG] Mock EC2 metadata server received request: /latest/api/token
2020/06/02 19:07:53 [DEBUG] Mock EC2 metadata server received request: /latest/api/token
2020/06/02 19:07:53 [INFO] Ignoring AWS metadata API endpoint at http://127.0.0.1:60498/latest as it doesn't return any instance-id
    TestGetSession/EC2_metadata_access_key: session_test.go:1013: expected no error, got error: No valid credential sources found for AWS Provider.
        	Please see https://terraform.io/docs/providers/aws/index.html for more information on
        	providing credentials for the AWS Provider
```
@dynnamitt dynnamitt mentioned this issue Mar 19, 2024
Open
PhillipGameDev added a commit to PhillipGameDev/AWS-SDK-GO-BACKEND that referenced this issue Dec 10, 2024
@PhillipGameDev
Implement configuration assume role duration, policy ARNs, tags, and …
70913a8 
…transitive tag keys (#39)

* deps: Update github.com/aws/aws-sdk-go@v1.31.9

To ensure we have all the latest and greatest STS features and prevent any confusion over the AWS Go SDK version minimum in this libary.

Updated via:

```
go get github.com/aws/aws-sdk-go@v1.31.9
go mod tidy
```

* Implement assume role duration, policy ARNs, tags, and transitive tag keys support

Reference: hashicorp/aws-sdk-go-base#11
Reference: hashicorp/aws-sdk-go-base#21
Reference: hashicorp/aws-sdk-go-base#34

* mock: Support EC2 Instance Metadata Service v2 /api/token endpoint

Otherwise, the updated AWS Go SDK EC2 Metadata client would return errors against the mock server.

```
=== RUN   TestGetSession/EC2_metadata_access_key
2020/06/02 19:07:53 [INFO] Attempting to use session-derived credentials
2020/06/02 19:07:53 [INFO] Setting custom EC2 metadata endpoint: http://127.0.0.1:60498/latest
2020/06/02 19:07:53 [DEBUG] Mock EC2 metadata server received request: /latest/api/token
2020/06/02 19:07:53 [DEBUG] Mock EC2 metadata server received request: /latest/api/token
2020/06/02 19:07:53 [DEBUG] Mock EC2 metadata server received request: /latest/api/token
2020/06/02 19:07:53 [INFO] Attempting to use metadata-derived credentials
2020/06/02 19:07:53 [INFO] Setting AWS metadata API timeout to 100ms
2020/06/02 19:07:53 [INFO] Setting custom metadata endpoint: "http://127.0.0.1:60498/latest"
2020/06/02 19:07:53 [DEBUG] Mock EC2 metadata server received request: /latest/api/token
2020/06/02 19:07:53 [DEBUG] Mock EC2 metadata server received request: /latest/api/token
2020/06/02 19:07:53 [DEBUG] Mock EC2 metadata server received request: /latest/api/token
2020/06/02 19:07:53 [DEBUG] Mock EC2 metadata server received request: /latest/api/token
2020/06/02 19:07:53 [INFO] Ignoring AWS metadata API endpoint at http://127.0.0.1:60498/latest as it doesn't return any instance-id
    TestGetSession/EC2_metadata_access_key: session_test.go:1013: expected no error, got error: No valid credential sources found for AWS Provider.
        	Please see https://terraform.io/docs/providers/aws/index.html for more information on
        	providing credentials for the AWS Provider
```
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees

@bflad bflad

Labels
enhancement New feature or request
Projects
None yet
Milestone
v0.5.0
2 participants
@bflad @robh007