AssumeRole doesn't use the external_id value

[cyberduck]

6a74f0f created the issue

Hello,

CyberDuck fails to do an AWS IAM AssumeRole when trying to use S3 because it doesn't pass along the external_id value from the ~/.aws/credential profile.

I'm using CyberDuck to access AWS S3 resources using an AssumeRole action. I would like to be able to use the external_id enforcement as suggested by AWS https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_create_for-user_externalid.html

I'm not sure if you want to label this as a defect enhancement or feature. Feel free to adjust priority and severity as you see fit.

When I remove the external_id constraint on the role the AssumeRole succeeds with CyberDuck. I also verified using the same profile via the CLI with external_id enforced on the role and it succeeds so it looks to be an issue in CyberDuck.

Thank you for your time and creating CyberDuck

[cyberduck]

@dkocher commented

Thanks for reporting this issue.

[cyberduck]

@dkocher commented

~~Can you point to the documentation of the external_id property in the ~/.aws/credential configuration?~~

The AWS SDK uses this property thus it looks like this is by convention.

[cyberduck]

6a74f0f commented

In case it helps: https://docs.aws.amazon.com/cli/latest/topic/config-vars.html#using-aws-iam-roles

Example cleansed from my ~/.aws/credentials file

[user-identity]
aws_access_key_id     = USER_KEY
aws_secret_access_key = USER_SECRET

[assume-role]
role_arn              = arn:aws:iam::XXXXXXXXXXXX:role/ROLE
source_profile        = user-identity
external_id           = YYYYYYYYYYYYYYYYYYYYYYYYYYY

[cyberduck]

@dkocher commented

In e06c63b.

[cyberduck]

6a74f0f commented

Thank you for fixing this so quickly!

[cyberduck]

@dkocher commented

Milestone renamed