AWS SSO & role assumption chaining

[mzatt]

Hello,
We are using AWS SSO (Identity Center) for our users. We have an IAM role, that is used to assume an external 3rd party IAM role to access S3 resources. We need to provide users access to these 3rd party resources in Cyberduck.

Using the AWS cli, this assumption works correctly. aws s3 ls s3://external-bucket --profile external, using the AWS SSO credentials as a starting point, we can chain assumptions to access the 3rd party bucket.

But with Cyberduck, it looks like the credentials used are from cache, so chaining multiple roles does not look like it will work.
Example configs

• ~/.aws/config

[profile example]
sso_account_id = 12345678910
sso_role_name = example
region = us-east-1
output = json
sso_start_url = https://d-12341234123.awsapps.com/start
sso_region = us-east-1
sso_registration_scopes = sso:account:access

• ~/.aws/credentials

[internal]
role_arn = arn:aws:iam::12345678910:role/internal
source_profile = example

[external]
role_arn = arn:aws:iam::10987654321:role/External
source_profile = internal
external_id = 1asdf2rrasdf

[dkocher]

I assume you are using the S3 (Credentials from AWS Command Line Interface) profile to connect with credentials from AWS CLI ¹. You should test with the current snapshot build for any improvement as we have refactored the authentication strategies for S3 which should now also properly refresh credentials from the AWS CLI cache when expired.

Still using AWS SSO you will have to periodically run the SSO flow from the CLI with aws sts get-caller-identity --profile. This is an open issue ² that we have been unable to resolve with [^3] as AWS SSO (AWS IAM Identity Center) does not have proper support for OpenID Connect [^4].

If you are unable to make this work at all, please attach a Debug log file.

Footnotes

1. https://docs.cyberduck.io/protocols/s3/#connecting-using-credentials-from-aws-command-line-interface ↩

2. Integration with AWS IAM Identity Center #13377
   [^3] Suport to login using temporary credentials from Security Token Service (STS API) using OpenID Connect web identity #13804
   [^4] https://github.com/iterate-ch/cyberduck/issues/13377#issuecomment-1695961553 ↩