Limit role session name length to 64 characters.

Originally fixed by @SinisterMinister Fixes #741
getsops · Apr 4, 2022 · 1bb30e2 · 1bb30e2
1 parent 268b5ff
commit 1bb30e2
Showing 1 changed file with 7 additions and 0 deletions.
diff --git a/kms/keysource.go b/kms/keysource.go
@@ -172,6 +172,13 @@ func (key MasterKey) createStsSession(config aws.Config, sess *session.Session)
 	sanitizedHostname := stsRoleSessionNameRe.ReplaceAllString(hostname, "")
 	stsService := sts.New(sess)
 	name := "sops@" + sanitizedHostname
+
+	// Make sure the name is no longer than 64 characters (role session name length limit from AWS)
+	roleSessionNameLengthLimit := 64
+	if len(name) >= roleSessionNameLengthLimit {
+		name = name[:roleSessionNameLengthLimit]
+	}
+
 	out, err := stsService.AssumeRole(&sts.AssumeRoleInput{
 		RoleArn: &key.Role, RoleSessionName: &name})
 	if err != nil {