Improve allowed account handling #363
Merged
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Per envato#362, the returned error message doesn't explain why the IAM permission was required. While the wrapped error doesn't mention the specific permission, the original MissingIamPermissionsError can still be seen in --trace output, as it is registered as the Error#cause
As highlighted in envato#362, if the current account ID doesn't match anything in the allowed accounts list, and the current principal doesn't have iam:ListAccountAliases privileges, Identity#running_in_account? will fail due to an attempt to get account aliases. This adds an erroring test case for that scenario, and the corresponding expected failure when account aliases are actually in use.
When the current account ID doesn't match any of the provided allowed_accounts, Identity would automatically fetch listed aliases. If the principal didn't have permissions to retrieve those, this would result in an error. When all of the provided "allowed account" values are valid AWS account IDs, it's currently impossible that an account alias would match, so we can skip the call, avoiding the potential permissions issue.
petervandoros
approved these changes
Oct 5, 2021
patrobinson
approved these changes
Oct 7, 2021
|
|
||
| contains_account_alias?(accounts) | ||
| rescue MissingIamPermissionsError | ||
| raise AllowedAccountAliasesError, 'Failed to validate whether the current AWS account is allowed' |
There was a problem hiding this comment.
Does this mask the access denied error message?
There was a problem hiding this comment.
Yes, I noted that you can work around that if you're investigating the issue:
Note that the previous error message (identifying the missing IAM permission) is no longer shown, but can be seen with
--trace, as theMissingIamPermissionsErroris recorded as theError#causeof theAllowedAccountAliasesError.
|
I'll update the changelog. Should I also bump the version number? Will we cut a release for this change, or will we wait? |
|
@liamdawson changes are pretty infrequent so I think we'd be better bumping this with a minor version change. |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Per #362, there's some opportunity for improvement around allowed account logic. This PR introduces two changes:
Return a more contextual error message when
Identity#account_aliasesraises an IAM permissions error inIdentity#running_in_account?— previously, users had to examine the stack trace to work out which part of the application logic triggered the error.Note that the previous error message (identifying the missing IAM permission) is no longer shown, but can be seen with
--trace, as theMissingIamPermissionsErroris recorded as theError#causeof theAllowedAccountAliasesError.Avoid checking the current account's aliases against the
allowed_accountslist if all values are 12-digit numbers (i.e. AWS account IDs) — considering the way AWS account aliases are used, it should not be possible to use a 12-digit number as an account aliasSome tests had to be updated when making this change, as they used AWS account IDs of an incorrect length.