Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Use "role_session_name" parameter inside "~/.aws/config" when switching roles #107

Closed
eduardohki opened this issue Jun 12, 2020 · 2 comments

Comments

@eduardohki
Copy link

Hello,

First of all, thank you very much for making AWSume!

I have a use-case which may be relevant to others: when using AWSume to switch roles to another account based on previous IAM User keys, I would like AWSume to make use of the role_session_name provided inside my ~/.aws/config file by default (if any).

This would be very relevant for Auditing purposes.

I have a use-case where every IAM User has to set its own email in the role_session_name field, so the user issuing AWS CLI and Terraform calls can be easily spotted in CloudTrail.

For example, in the following aws-cli configuration:

[profile my_iam_user]
region = eu-central-1
mfa_serial = arn:aws:iam::00000000000:mfa/my_iam_user

[profile my_iam_role_on_another_account]
region = eu-central-1
role_arn = arn:aws:iam::111111111111:role/Administrator
source_profile = my_iam_user
role_session_name = my@email.com

If I don't specify the flag --session-name every time I want to switch to another account's Role, AWSume will set the role_session_name as the name of the profile itself (e.g. my_iam_role_on_another_account, in this case):

$ awsume my_iam_role_on_another_account
$ aws sts get-caller-identity
{
  "UserId": "ASDF27V5K4EYKONUOHJKL:my_iam_role_on_another_account",
  "Account": "111111111111",
  "Arn": "arn:aws:iam::111111111111:role/Administrator/my_iam_role_on_another_account"
}

What I would like AWSume to do by default, is to use the role_session_name parameter by default, if no --session-name flag is set:

$ awsume my_iam_role_on_another_account
$ aws sts get-caller-identity
{
  "UserId": "ASDF27V5K4EYKONUOHJKL:my@email.com",
  "Account": "111111111111",
  "Arn": "arn:aws:iam::111111111111:role/Administrator/my@email.com"
}

Thank you!

@eduardohki
Copy link
Author

Oh, I just saw #100

Feel free to close this one, if you deem so.

@mbarneyjr
Copy link
Member

Closing in favor of #100

(this has been implemented, full update found in the first issue)

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

2 participants