Skip to content

Commit 1beab95

Browse files
authored
Merge pull request #12 from toricls/support-iam-roles-with-slashes-in-role-name
Run permission check with IAM role ARN when it runs with assumed IAM role
2 parents 93fb8c3 + 73cc93c commit 1beab95

File tree

1 file changed

+18
-2
lines changed

1 file changed

+18
-2
lines changed

check-ecs-exec.sh

Lines changed: 18 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -19,7 +19,9 @@ set -euo pipefail
1919
## https://aws.amazon.com/blogs/containers/new-using-amazon-ecs-exec-access-your-containers-fargate-ec2/
2020
##
2121

22-
## NOTE: This script needs the following permissions.
22+
## NOTE: This script needs the following permissions.
23+
## If you use an IAM user with an assumed role to run the script,
24+
## then you need allow the "iam:ListRoles" action in addition to the following.
2325
## {
2426
## "Version": "2012-10-17",
2527
## "Statement": [
@@ -71,6 +73,11 @@ equalsOrGreaterVersion() {
7173
fi
7274
false
7375
}
76+
getRoleArnForAssumedRole() {
77+
callerIdentityJson=$1
78+
ROLE_ID=$(echo "${callerIdentityJson}" | jq -r ".UserId" | cut -d: -f1)
79+
aws iam list-roles --query "Roles[?RoleId=='${ROLE_ID}'].Arn" --output text
80+
}
7481
# For `iam simulate-principal-policy`
7582
readEvalDecision() {
7683
evalResultsJson=$1
@@ -122,7 +129,16 @@ AWS_REGION=${AWS_REGION:-$REGION}
122129

123130
callerIdentityJson=$(${AWS_CLI_BIN} sts get-caller-identity)
124131
ACCOUNT_ID=$(echo "${callerIdentityJson}" | jq -r ".Account")
125-
MY_IAM_ARN=$(echo "${callerIdentityJson}" | jq -r '.Arn |= sub("assumed-role"; "role") | .Arn' | cut -f1,2 -d'/')
132+
CALLER_IAM_ARN=$(echo "${callerIdentityJson}" | jq -r ".Arn")
133+
case "${CALLER_IAM_ARN}" in
134+
*:user/*|*:role/*|*:group/* ) MY_IAM_ARN="${CALLER_IAM_ARN}";;
135+
*:assumed-role/*) MY_IAM_ARN=$(getRoleArnForAssumedRole "${callerIdentityJson}");;
136+
* ) printf "${COLOR_RED}Pre-flight check failed: The ARN \"${CALLER_IAM_ARN}\" associated with the caller(=you) is not supported. Try again either with one of an IAM user, an IAM role, or an assumed IAM role.\n" >&2 && exit 1;;
137+
esac
138+
if [[ "x${MY_IAM_ARN}" = "x" ]]; then
139+
printf "${COLOR_RED}Unknown error: Failed to get the role ARN of the caller(=you).\n" >&2
140+
exit 1
141+
fi
126142

127143
# Check task existence
128144
describedTaskJson=$(${AWS_CLI_BIN} ecs describe-tasks \

0 commit comments

Comments
 (0)