get_session_token does not return a full credentials object

[vancluever]

The Aws::STS::Types::Credentials object returned by the get_session_token class does not seem to be a full credentials object and does not respond to either set? or #credentials and hence does not seem suitable to be used as a default in Aws.config.

Is there a specific reason for this?

[awood45]

The answer to your exact question is that the object is a representation of the STS API model, and doesn't have any higher level features decorated in.

What I am thinking, however, is that there is a feature request to have a credential provider that uses STS in this manner, or that can easily consume this response to create an Aws::Credentials object.

What are you trying to do? Asking to craft the right feature request.

[vancluever]

Basically, I want MFA without having to assume a role. So the idea would be to get the session, and set that as the default credentials using Aws.config. If a role needs to be assumed later, that session can overwrite the credentials set after the fact, and/or the old credentials can be stashed so they can be switched back to easily after one is done with the assumed role's session.

I am hoping this will allow the ability to assume multiple roles in a single session without having to re-enter MFA. Also, it enables access to stuff that the IAM user has access to without a role but is restricted by MFA in the policy.

The workaround I see right now is to set access_key_id, secret_access_key, and session_token directly. The, setting credentials seems to override this, so I can use this when I want to assume a role and just use AssumeRoleCredentials. After I am done with the assumed role session I can just delete that key. I'm not too sure if that is something I can count on though...

[awood45]

We do provide an abstraction around AssumeRoleCredentials, but it may require some tweaking to handle a plain #get_session_token call. I'll toy around with this over the weekend.

[vancluever]

Thanks Alex!

[trevorrowe]

I've closed this issue and moved it to our feature requests.

[vancluever]

Thanks Trevor,

I don't necessarily need this right now, the use case I needed it for has changed pretty drastically since I asked about this, but it would be cool to see still!

[bhouse]

An example of a workaround for this: https://gist.github.com/bhouse/f97980adc5df2b5db7fd435a6112c4d8