@@ -40,26 +40,17 @@ def _get_current_aws_identity(session: boto3.Session) -> Tuple[str, str]:
4040 parts = arn .split ('/' )
4141 if len (parts ) >= 3 :
4242 role_name = parts [1 ] # Extract role name from ARN
43-
44- # Validate role name before API call
45- if not role_name or not role_name .strip ():
46- logger .debug (f"Invalid role name extracted from ARN: { arn } " )
43+
44+ # Try IAM API first (preferred method)
45+ try :
46+ iam_client = session .client ('iam' )
47+ role_response = iam_client .get_role (RoleName = role_name )
48+ # Use actual ARN from IAM API
49+ arn = role_response ['Role' ]['Arn' ]
50+ logger .debug (f"Retrieved base role ARN from IAM API: { arn } " )
51+ except Exception as e :
52+ logger .debug (f"IAM API failed, falling back to string replacement: { e } " )
4753 arn = arn .replace (':sts:' , ':iam:' ).replace (':assumed-role/' , ':role/' ).rsplit ('/' , 1 )[0 ]
48- else :
49- # Try IAM API first (preferred method)
50- try :
51- iam_client = session .client ('iam' )
52- role_response = iam_client .get_role (RoleName = role_name )
53- arn = role_response ['Role' ]['Arn' ] # Use actual ARN from IAM API
54- logger .debug (f"Retrieved base role ARN from IAM API: { arn } " )
55- except ClientError as e :
56- # Fall back to string replacement if IAM API fails
57- logger .debug (f"IAM API failed, falling back to string replacement: { e } " )
58- arn = arn .replace (':sts:' , ':iam:' ).replace (':assumed-role/' , ':role/' ).rsplit ('/' , 1 )[0 ]
59- except Exception as e :
60- # Fall back to string replacement for any other errors
61- logger .debug (f"Unexpected error with IAM API, falling back to string replacement: { e } " )
62- arn = arn .replace (':sts:' , ':iam:' ).replace (':assumed-role/' , ':role/' ).rsplit ('/' , 1 )[0 ]
6354 else :
6455 identity_type = 'unknown'
6556
0 commit comments