Skip to content

Commit

Permalink
Remove max tags check
Browse files Browse the repository at this point in the history
Prefer to let the AWS API enforce its own constraints. If the max number
of tags is exceeded AWS will return an error.

In addition, the check was never being enforced since it as conditional
on an invalid config error.
  • Loading branch information
benashz committed Jun 26, 2024
1 parent 03583e9 commit 90769d2
Showing 1 changed file with 1 addition and 4 deletions.
5 changes: 1 addition & 4 deletions builtin/logical/aws/path_roles.go
Original file line number Diff line number Diff line change
Expand Up @@ -16,6 +16,7 @@ import (
"github.com/aws/aws-sdk-go/aws/arn"
"github.com/hashicorp/go-multierror"
"github.com/hashicorp/go-secure-stdlib/strutil"

"github.com/hashicorp/vault/sdk/framework"
"github.com/hashicorp/vault/sdk/helper/consts"
"github.com/hashicorp/vault/sdk/logical"
Expand Down Expand Up @@ -642,10 +643,6 @@ func (r *awsRoleEntry) validate() error {

if len(r.SessionTags) > 0 && !strutil.StrListContains(r.CredentialTypes, assumedRoleCred) {
errors = multierror.Append(errors, fmt.Errorf("cannot supply session_tags when credential_type isn't %s", assumedRoleCred))
// https://docs.aws.amazon.com/IAM/latest/UserGuide/id_session-tags.html#id_session-tags_know
if len(r.SessionTags) > 50 {
errors = multierror.Append(errors, fmt.Errorf("cannot supply more than %d session_tags", 50))
}
}

if r.ExternalID != "" && !strutil.StrListContains(r.CredentialTypes, assumedRoleCred) {
Expand Down

0 comments on commit 90769d2

Please sign in to comment.