Skip to content

Commit 1cc4c75

Browse files
mondemonde
committed
m2m allow STS role session name to be overridden with --aws-sts-role-session-name [value] CLI flag.
1 parent e26279e commit 1cc4c75

File tree

4 files changed

+169
-138
lines changed

4 files changed

+169
-138
lines changed

‎README.md‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -470,6 +470,7 @@ These settings are optional unless marked otherwise:
470470
| Private Key File (**required** in lieu of private key) | File holding PEM (pkcs#1 or pkcs#9) private key whose public key is stored on the service app | `--private-key-file [value]` | `OKTA_AWSCLI_PRIVATE_KEY_FILE` |
471471
| Authorization Server ID | The ID of the Okta authorization server, set ID for a custom authorization server, will use default otherwise. Default `default` | `--authz-id [value]` | `OKTA_AWSCLI_AUTHZ_ID` |
472472
| Custom scope name | The custom scope established in the custom authorization server. Default `okta-m2m-access` | `--custom-scope [value]` | `OKTA_AWSCLI_CUSTOM_SCOPE` |
473+
| Custom STS Role Session Name | Customize STS Role Session Name. Default `okta-aws-cli` | `--aws-sts-role-session-name [value]` | `OKTA_AWSCLI_STS_ROLE_SESSION_NAME` |
473474

474475
### Friendly IdP and Role menu labels
475476

‎cmd/root/m2m/m2m.go‎

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -61,6 +61,13 @@ var (
6161
Usage: "Custom Authorization Server ID",
6262
EnvVar: config.AuthzIDEnvVar,
6363
},
64+
{
65+
Name: config.AWSSTSRoleSessionNameFlag,
66+
Short: "q",
67+
Value: "okta-aws-cli",
68+
Usage: "STS Role Session Name",
69+
EnvVar: config.AWSSTSRoleSessionNameEnvVar,
70+
},
6471
}
6572
requiredFlags = []interface{}{"org-domain", "oidc-client-id", "aws-iam-role", "key-id", []string{"private-key", "private-key-file"}}
6673
)

‎internal/config/config.go‎

Lines changed: 160 additions & 137 deletions
Original file line numberDiff line numberDiff line change
@@ -80,6 +80,8 @@ const (
8080
AWSIAMRoleFlag = "aws-iam-role"
8181
// AWSRegionFlag cli flag const
8282
AWSRegionFlag = "aws-region"
83+
// AWSSTSRoleSessionNameFlag cli flag const
84+
AWSSTSRoleSessionNameFlag = "aws-sts-role-session-name"
8385
// CustomScopeFlag cli flag const
8486
CustomScopeFlag = "custom-scope"
8587
// DebugFlag cli flag const
@@ -139,6 +141,8 @@ const (
139141
AWSSessionDurationEnvVar = "OKTA_AWSCLI_SESSION_DURATION"
140142
// AWSRegionEnvVar env var const
141143
AWSRegionEnvVar = "OKTA_AWSCLI_AWS_REGION"
144+
// AWSSTSRoleSessionNameEnvVar env var const
145+
AWSSTSRoleSessionNameEnvVar = "OKTA_AWSCLI_STS_ROLE_SESSION_NAME"
142146
// CacheAccessTokenEnvVar env var const
143147
CacheAccessTokenEnvVar = "OKTA_AWSCLI_CACHE_ACCESS_TOKEN"
144148
// CustomScopeEnvVar env var const
@@ -214,32 +218,33 @@ type OktaYamlConfig struct {
214218
// name. This is a convenience struct pretty printing profile information from
215219
// the list profiles command cmd/root/profileslist/profiles-list.go
216220
type OktaYamlConfigProfile struct {
217-
AllProfiles string `yaml:"all-profiles"`
218-
AuthzID string `yaml:"authz-id"`
219-
AWSAcctFedAppID string `yaml:"aws-acct-fed-app-id"`
220-
AWSCredentials string `yaml:"aws-credentials"`
221-
AWSIAMIdP string `yaml:"aws-iam-idp"`
222-
AWSIAMRole string `yaml:"aws-iam-role"`
223-
AWSRegion string `yaml:"aws-region"`
224-
CustomScope string `yaml:"custom-scope"`
225-
Debug string `yaml:"debug"`
226-
DebugAPICalls string `yaml:"debug-api-calls"`
227-
Exec string `yaml:"exec"`
228-
Format string `yaml:"format"`
229-
OIDCClientID string `yaml:"oidc-client-id"`
230-
OpenBrowser string `yaml:"open-browser"`
231-
OpenBrowserCommand string `yaml:"open-browser-command"`
232-
OrgDomain string `yaml:"org-domain"`
233-
PrivateKey string `yaml:"private-key"`
234-
PrivateKeyFile string `yaml:"private-key-file"`
235-
KeyID string `yaml:"key-id"`
236-
Profile string `yaml:"profile"`
237-
QRCode string `yaml:"qr-code"`
238-
SessionDuration string `yaml:"session-duration"`
239-
WriteAWSCredentials string `yaml:"write-aws-credentials"`
240-
LegacyAWSVariables string `yaml:"legacy-aws-variables"`
241-
ExpiryAWSVariables string `yaml:"expiry-aws-variables"`
242-
CacheAccessToken string `yaml:"cache-access-token"`
221+
AllProfiles string `yaml:"all-profiles"`
222+
AuthzID string `yaml:"authz-id"`
223+
AWSAcctFedAppID string `yaml:"aws-acct-fed-app-id"`
224+
AWSCredentials string `yaml:"aws-credentials"`
225+
AWSIAMIdP string `yaml:"aws-iam-idp"`
226+
AWSIAMRole string `yaml:"aws-iam-role"`
227+
AWSRegion string `yaml:"aws-region"`
228+
AWSSTSRoleSessionName string `yaml:"aws-sts-role-session-name"`
229+
CustomScope string `yaml:"custom-scope"`
230+
Debug string `yaml:"debug"`
231+
DebugAPICalls string `yaml:"debug-api-calls"`
232+
Exec string `yaml:"exec"`
233+
Format string `yaml:"format"`
234+
OIDCClientID string `yaml:"oidc-client-id"`
235+
OpenBrowser string `yaml:"open-browser"`
236+
OpenBrowserCommand string `yaml:"open-browser-command"`
237+
OrgDomain string `yaml:"org-domain"`
238+
PrivateKey string `yaml:"private-key"`
239+
PrivateKeyFile string `yaml:"private-key-file"`
240+
KeyID string `yaml:"key-id"`
241+
Profile string `yaml:"profile"`
242+
QRCode string `yaml:"qr-code"`
243+
SessionDuration string `yaml:"session-duration"`
244+
WriteAWSCredentials string `yaml:"write-aws-credentials"`
245+
LegacyAWSVariables string `yaml:"legacy-aws-variables"`
246+
ExpiryAWSVariables string `yaml:"expiry-aws-variables"`
247+
CacheAccessToken string `yaml:"cache-access-token"`
243248
}
244249

245250
// Clock interface to abstract time operations
@@ -254,67 +259,69 @@ type Clock interface {
254259
// control data access, be concerned with evaluation, validation, and not
255260
// allowing direct access to values as is done on structs in the generic case.
256261
type Config struct {
257-
allProfiles bool
258-
authzID string
259-
awsCredentials string
260-
awsIAMIdP string
261-
awsIAMRole string
262-
awsRegion string
263-
awsSessionDuration int64
264-
cacheAccessToken bool
265-
customScope string
266-
debug bool
267-
debugAPICalls bool
268-
exec bool
269-
expiryAWSVariables bool
270-
fedAppID string
271-
format string
272-
httpClient *http.Client
273-
keyID string
274-
legacyAWSVariables bool
275-
oidcAppID string
276-
openBrowser bool
277-
openBrowserCommand string
278-
orgDomain string
279-
privateKey string
280-
privateKeyFile string
281-
profile string
282-
qrCode bool
283-
shortUserAgent bool
284-
writeAWSCredentials bool
285-
clock Clock
286-
Logger logger.Logger
262+
allProfiles bool
263+
authzID string
264+
awsCredentials string
265+
awsIAMIdP string
266+
awsIAMRole string
267+
awsRegion string
268+
awsSessionDuration int64
269+
awsSTSRoleSessionName string
270+
cacheAccessToken bool
271+
customScope string
272+
debug bool
273+
debugAPICalls bool
274+
exec bool
275+
expiryAWSVariables bool
276+
fedAppID string
277+
format string
278+
httpClient *http.Client
279+
keyID string
280+
legacyAWSVariables bool
281+
oidcAppID string
282+
openBrowser bool
283+
openBrowserCommand string
284+
orgDomain string
285+
privateKey string
286+
privateKeyFile string
287+
profile string
288+
qrCode bool
289+
shortUserAgent bool
290+
writeAWSCredentials bool
291+
clock Clock
292+
Logger logger.Logger
287293
}
288294

289295
// Attributes attributes for config construction
290296
type Attributes struct {
291-
AllProfiles bool
292-
AuthzID string
293-
AWSCredentials string
294-
AWSIAMIdP string
295-
AWSIAMRole string
296-
AWSRegion string
297-
AWSSessionDuration int64
298-
CacheAccessToken bool
299-
CustomScope string
300-
Debug bool
301-
DebugAPICalls bool
302-
Exec bool
303-
ExpiryAWSVariables bool
304-
FedAppID string
305-
Format string
306-
KeyID string
307-
LegacyAWSVariables bool
308-
OIDCAppID string
309-
OpenBrowser bool
310-
OpenBrowserCommand string
311-
OrgDomain string
312-
PrivateKey string
313-
PrivateKeyFile string
314-
Profile string
315-
QRCode bool
316-
ShortUserAgent bool
317-
WriteAWSCredentials bool
297+
AllProfiles bool
298+
AuthzID string
299+
AWSCredentials string
300+
AWSIAMIdP string
301+
AWSIAMRole string
302+
AWSRegion string
303+
AWSSessionDuration int64
304+
AWSSTSRoleSessionName string
305+
CacheAccessToken bool
306+
CustomScope string
307+
Debug bool
308+
DebugAPICalls bool
309+
Exec bool
310+
ExpiryAWSVariables bool
311+
FedAppID string
312+
Format string
313+
KeyID string
314+
LegacyAWSVariables bool
315+
OIDCAppID string
316+
OpenBrowser bool
317+
OpenBrowserCommand string
318+
OrgDomain string
319+
PrivateKey string
320+
PrivateKeyFile string
321+
Profile string
322+
QRCode bool
323+
ShortUserAgent bool
324+
WriteAWSCredentials bool
318325
}
319326

320327
// NewEvaluatedConfig Returns a new config loading and evaluating attributes in
@@ -345,33 +352,34 @@ func NewEvaluatedConfig() (*Config, error) {
345352
func NewConfig(attrs *Attributes) (*Config, error) {
346353
var err error
347354
cfg := &Config{
348-
allProfiles: attrs.AllProfiles,
349-
authzID: attrs.AuthzID,
350-
awsCredentials: attrs.AWSCredentials,
351-
awsIAMIdP: attrs.AWSIAMIdP,
352-
awsIAMRole: attrs.AWSIAMRole,
353-
awsRegion: attrs.AWSRegion,
354-
awsSessionDuration: attrs.AWSSessionDuration,
355-
cacheAccessToken: attrs.CacheAccessToken,
356-
customScope: attrs.CustomScope,
357-
debug: attrs.Debug,
358-
debugAPICalls: attrs.DebugAPICalls,
359-
exec: attrs.Exec,
360-
expiryAWSVariables: attrs.ExpiryAWSVariables,
361-
fedAppID: attrs.FedAppID,
362-
format: attrs.Format,
363-
keyID: attrs.KeyID,
364-
legacyAWSVariables: attrs.LegacyAWSVariables,
365-
oidcAppID: attrs.OIDCAppID,
366-
openBrowser: attrs.OpenBrowser,
367-
openBrowserCommand: attrs.OpenBrowserCommand,
368-
orgDomain: attrs.OrgDomain,
369-
privateKey: attrs.PrivateKey,
370-
privateKeyFile: attrs.PrivateKeyFile,
371-
profile: attrs.Profile,
372-
qrCode: attrs.QRCode,
373-
shortUserAgent: attrs.ShortUserAgent,
374-
writeAWSCredentials: attrs.WriteAWSCredentials,
355+
allProfiles: attrs.AllProfiles,
356+
authzID: attrs.AuthzID,
357+
awsCredentials: attrs.AWSCredentials,
358+
awsIAMIdP: attrs.AWSIAMIdP,
359+
awsIAMRole: attrs.AWSIAMRole,
360+
awsRegion: attrs.AWSRegion,
361+
awsSessionDuration: attrs.AWSSessionDuration,
362+
awsSTSRoleSessionName: attrs.AWSSTSRoleSessionName,
363+
cacheAccessToken: attrs.CacheAccessToken,
364+
customScope: attrs.CustomScope,
365+
debug: attrs.Debug,
366+
debugAPICalls: attrs.DebugAPICalls,
367+
exec: attrs.Exec,
368+
expiryAWSVariables: attrs.ExpiryAWSVariables,
369+
fedAppID: attrs.FedAppID,
370+
format: attrs.Format,
371+
keyID: attrs.KeyID,
372+
legacyAWSVariables: attrs.LegacyAWSVariables,
373+
oidcAppID: attrs.OIDCAppID,
374+
openBrowser: attrs.OpenBrowser,
375+
openBrowserCommand: attrs.OpenBrowserCommand,
376+
orgDomain: attrs.OrgDomain,
377+
privateKey: attrs.PrivateKey,
378+
privateKeyFile: attrs.PrivateKeyFile,
379+
profile: attrs.Profile,
380+
qrCode: attrs.QRCode,
381+
shortUserAgent: attrs.ShortUserAgent,
382+
writeAWSCredentials: attrs.WriteAWSCredentials,
375383
}
376384
err = cfg.SetOrgDomain(attrs.OrgDomain)
377385
if err != nil {
@@ -462,33 +470,34 @@ func loadConfigAttributesFromFlagsAndVars() (Attributes, error) {
462470
}
463471

464472
attrs := Attributes{
465-
AllProfiles: viper.GetBool(getFlagNameFromProfile(awsProfile, AllProfilesFlag)),
466-
AuthzID: viper.GetString(getFlagNameFromProfile(awsProfile, AuthzIDFlag)),
467-
AWSCredentials: viper.GetString(getFlagNameFromProfile(awsProfile, AWSCredentialsFlag)),
468-
AWSIAMIdP: viper.GetString(getFlagNameFromProfile(awsProfile, AWSIAMIdPFlag)),
469-
AWSIAMRole: viper.GetString(getFlagNameFromProfile(awsProfile, AWSIAMRoleFlag)),
470-
AWSRegion: viper.GetString(getFlagNameFromProfile(awsProfile, AWSRegionFlag)),
471-
AWSSessionDuration: viper.GetInt64(getFlagNameFromProfile(awsProfile, SessionDurationFlag)),
472-
CustomScope: viper.GetString(getFlagNameFromProfile(awsProfile, CustomScopeFlag)),
473-
Debug: viper.GetBool(getFlagNameFromProfile(awsProfile, DebugFlag)),
474-
DebugAPICalls: viper.GetBool(getFlagNameFromProfile(awsProfile, DebugAPICallsFlag)),
475-
Exec: viper.GetBool(getFlagNameFromProfile(awsProfile, ExecFlag)),
476-
FedAppID: viper.GetString(getFlagNameFromProfile(awsProfile, AWSAcctFedAppIDFlag)),
477-
Format: viper.GetString(getFlagNameFromProfile(awsProfile, FormatFlag)),
478-
LegacyAWSVariables: viper.GetBool(getFlagNameFromProfile(awsProfile, LegacyAWSVariablesFlag)),
479-
ExpiryAWSVariables: viper.GetBool(getFlagNameFromProfile(awsProfile, ExpiryAWSVariablesFlag)),
480-
CacheAccessToken: viper.GetBool(getFlagNameFromProfile(awsProfile, CacheAccessTokenFlag)),
481-
OIDCAppID: viper.GetString(getFlagNameFromProfile(awsProfile, OIDCClientIDFlag)),
482-
OpenBrowser: viper.GetBool(getFlagNameFromProfile(awsProfile, OpenBrowserFlag)),
483-
OpenBrowserCommand: viper.GetString(getFlagNameFromProfile(awsProfile, OpenBrowserCommandFlag)),
484-
OrgDomain: viper.GetString(getFlagNameFromProfile(awsProfile, OrgDomainFlag)),
485-
PrivateKey: viper.GetString(getFlagNameFromProfile(awsProfile, PrivateKeyFlag)),
486-
PrivateKeyFile: viper.GetString(getFlagNameFromProfile(awsProfile, PrivateKeyFileFlag)),
487-
KeyID: viper.GetString(getFlagNameFromProfile(awsProfile, KeyIDFlag)),
488-
Profile: awsProfile,
489-
QRCode: viper.GetBool(getFlagNameFromProfile(awsProfile, QRCodeFlag)),
490-
ShortUserAgent: viper.GetBool(getFlagNameFromProfile(awsProfile, ShortUserAgentFlag)),
491-
WriteAWSCredentials: viper.GetBool(getFlagNameFromProfile(awsProfile, WriteAWSCredentialsFlag)),
473+
AllProfiles: viper.GetBool(getFlagNameFromProfile(awsProfile, AllProfilesFlag)),
474+
AuthzID: viper.GetString(getFlagNameFromProfile(awsProfile, AuthzIDFlag)),
475+
AWSCredentials: viper.GetString(getFlagNameFromProfile(awsProfile, AWSCredentialsFlag)),
476+
AWSIAMIdP: viper.GetString(getFlagNameFromProfile(awsProfile, AWSIAMIdPFlag)),
477+
AWSIAMRole: viper.GetString(getFlagNameFromProfile(awsProfile, AWSIAMRoleFlag)),
478+
AWSRegion: viper.GetString(getFlagNameFromProfile(awsProfile, AWSRegionFlag)),
479+
AWSSessionDuration: viper.GetInt64(getFlagNameFromProfile(awsProfile, SessionDurationFlag)),
480+
AWSSTSRoleSessionName: viper.GetString(getFlagNameFromProfile(awsProfile, AWSSTSRoleSessionNameFlag)),
481+
CustomScope: viper.GetString(getFlagNameFromProfile(awsProfile, CustomScopeFlag)),
482+
Debug: viper.GetBool(getFlagNameFromProfile(awsProfile, DebugFlag)),
483+
DebugAPICalls: viper.GetBool(getFlagNameFromProfile(awsProfile, DebugAPICallsFlag)),
484+
Exec: viper.GetBool(getFlagNameFromProfile(awsProfile, ExecFlag)),
485+
FedAppID: viper.GetString(getFlagNameFromProfile(awsProfile, AWSAcctFedAppIDFlag)),
486+
Format: viper.GetString(getFlagNameFromProfile(awsProfile, FormatFlag)),
487+
LegacyAWSVariables: viper.GetBool(getFlagNameFromProfile(awsProfile, LegacyAWSVariablesFlag)),
488+
ExpiryAWSVariables: viper.GetBool(getFlagNameFromProfile(awsProfile, ExpiryAWSVariablesFlag)),
489+
CacheAccessToken: viper.GetBool(getFlagNameFromProfile(awsProfile, CacheAccessTokenFlag)),
490+
OIDCAppID: viper.GetString(getFlagNameFromProfile(awsProfile, OIDCClientIDFlag)),
491+
OpenBrowser: viper.GetBool(getFlagNameFromProfile(awsProfile, OpenBrowserFlag)),
492+
OpenBrowserCommand: viper.GetString(getFlagNameFromProfile(awsProfile, OpenBrowserCommandFlag)),
493+
OrgDomain: viper.GetString(getFlagNameFromProfile(awsProfile, OrgDomainFlag)),
494+
PrivateKey: viper.GetString(getFlagNameFromProfile(awsProfile, PrivateKeyFlag)),
495+
PrivateKeyFile: viper.GetString(getFlagNameFromProfile(awsProfile, PrivateKeyFileFlag)),
496+
KeyID: viper.GetString(getFlagNameFromProfile(awsProfile, KeyIDFlag)),
497+
Profile: awsProfile,
498+
QRCode: viper.GetBool(getFlagNameFromProfile(awsProfile, QRCodeFlag)),
499+
ShortUserAgent: viper.GetBool(getFlagNameFromProfile(awsProfile, ShortUserAgentFlag)),
500+
WriteAWSCredentials: viper.GetBool(getFlagNameFromProfile(awsProfile, WriteAWSCredentialsFlag)),
492501
}
493502
if attrs.Format == "" {
494503
attrs.Format = EnvVarFormat
@@ -521,6 +530,9 @@ func loadConfigAttributesFromFlagsAndVars() (Attributes, error) {
521530
if attrs.AWSIAMRole == "" {
522531
attrs.AWSIAMRole = viper.GetString(downCase(AWSIAMRoleEnvVar))
523532
}
533+
if attrs.AWSSTSRoleSessionName == "" {
534+
attrs.AWSSTSRoleSessionName = viper.GetString(downCase(AWSSTSRoleSessionNameEnvVar))
535+
}
524536
if !attrs.QRCode {
525537
attrs.QRCode = viper.GetBool(downCase(QRCodeEnvVar))
526538
}
@@ -722,6 +734,17 @@ func (c *Config) SetAWSSessionDuration(duration int64) error {
722734
return nil
723735
}
724736

737+
// AWSSTSRoleSessionName --
738+
func (c *Config) AWSSTSRoleSessionName() string {
739+
return c.awsSTSRoleSessionName
740+
}
741+
742+
// SetAWSSTSRoleSessionName --
743+
func (c *Config) SetAWSSTSRoleSessionName(name string) error {
744+
c.awsSTSRoleSessionName = name
745+
return nil
746+
}
747+
725748
// CacheAccessToken --
726749
func (c *Config) CacheAccessToken() bool {
727750
return c.cacheAccessToken

‎internal/m2mauth/m2mauth.go‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -127,7 +127,7 @@ func (m *M2MAuthentication) awsAssumeRoleWithWebIdentity(at *okta.AccessToken) (
127127
input := &sts.AssumeRoleWithWebIdentityInput{
128128
DurationSeconds: aws.Int64(m.config.AWSSessionDuration()),
129129
RoleArn: aws.String(m.config.AWSIAMRole()),
130-
RoleSessionName: aws.String("okta-aws-cli"),
130+
RoleSessionName: aws.String(m.config.AWSSTSRoleSessionName()),
131131
WebIdentityToken: &at.AccessToken,
132132
}
133133
svcResp, err := svc.AssumeRoleWithWebIdentity(input)

0 commit comments

Comments
 (0)