You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
In the m2m mode there are only two API calls being made:
Get access token from Okta POST /oauth2/{id}/v1/token
Present access token from Okta to AWS STS to get temp IAM creds POST /
We don't ever fetch anything from the Okta Management API about the application name or make any kinds of information gathering queries to the AWS API other than presetting the Okta Access token. So for m2m the only option that makes sense here is to allow the operator to set the role session name to something meaningful in their runtime.
In M2M okta-aws-cli hard codes the IAM role session name to "okta-aws-cli"
https://github.com/okta/okta-aws-cli/blob/master/internal/m2mauth/m2mauth.go#L126
Make this customizable for m2m operators to append meta info into the resulting IAM userId.
Current:
Something like
--aws-iam-role-session-name
Notes from PM:
Or, not overloading the session role name, put the okta client id and application name in as the role session name:
The text was updated successfully, but these errors were encountered: