Skip to content
This repository was archived by the owner on May 18, 2021. It is now read-only.

Merge session-ttl and assume-role-ttl parameters into one #256

Closed
sdann opened this issue Dec 5, 2019 · 1 comment
Closed

Merge session-ttl and assume-role-ttl parameters into one #256

sdann opened this issue Dec 5, 2019 · 1 comment
Labels

Comments

@sdann
Copy link
Contributor

sdann commented Dec 5, 2019

Forking from Issue #251

session_ttl is the duration of the STS creds for the initial AssumeRoleWithSAML() call.
assume_role_ttl is the duration of the creds for any secondary role that is assumed after the first.

This was very confusing at first. I had assumed session_ttl was the length of the Okta login session or Oka SAML assertion ttl.

Since the tool is only ever assuming 1 final role eventually, I suggest it use the same config parameter for both. For instance, with the change you'd have the following config file:

[profile ttldemo]
aws_saml_url = home/amazon_aws/cuZGoka9dAIFcyG0UllG/214
role_arn = arn:aws:iam::<account-id>:role/<okta-role-name>
session_ttl = 8h

[profile ttldemo-role]
source_profile = ttldemo
role_arn = arn:aws:iam::<account-id>:role/<secondary-role-name>
session_ttl = 1h

Running:
aws-okta env ttldemo - would provide an STS token with an 8 hour duration
aws-okta env ttldemo-role - would provide an STS token with a 1 hour duration

Same parameter used for both, making the UX much less confusing.

For backwards compatibility, we could support assume-role-ttl as a synonym for session-ttl for a few versions.

@nickatsegment
Copy link
Contributor

#278

Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Labels
Projects
None yet
Development

No branches or pull requests

2 participants