Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[FEATURE] Add --session-duration option to let user choose how many time last STS temporary credentials #13

Open
benjamin-brabant opened this issue Dec 4, 2020 · 0 comments
Labels
enhancement New feature or request

Comments

@benjamin-brabant
Copy link
Contributor

Is your feature request related to a problem? Please describe.
Currently we cannot ask awscli_saml_sso for a custom session-duration of generated STS temporary credentials.
We propose to add a --session-duration option to let user choose custom session duration.

Describe the solution you'd like
Add a --session-duration option which let user choose duration in seconds.

We have to ensure that provided value is between 900 (15 min) and 43200 (12 hours).
https://boto3.amazonaws.com/v1/documentation/api/latest/reference/services/sts.html#STS.Client.assume_role_with_saml

We also need to handle case when chosen value exceed the MaxSessionDuration set for the role which raised the following exception:

botocore.exceptions.ClientError: An error occurred (ValidationError) when calling the AssumeRoleWithSAML operation: The requested DurationSeconds exceeds the MaxSessionDuration set for this role.

see: https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_use.html#id_roles_use_view-role-max-session

@benjamin-brabant benjamin-brabant added the enhancement New feature or request label Dec 4, 2020
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
enhancement New feature or request
Projects
None yet
Development

No branches or pull requests

1 participant