Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Add argument/env var to set the session expiry for the AWS credentials. #14

Merged
merged 2 commits into from
Oct 24, 2022
Merged

Add argument/env var to set the session expiry for the AWS credentials. #14

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
83d4386
Add argument/env var to set the session expiry for the AWS credentials.
Oct 24, 2022
bad97db
Correct unintended whitespace and indentation
Oct 24, 2022
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
1 change: 1 addition & 0 deletions README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -95,6 +95,7 @@ Also see the CLI's online help `$ okta-aws-cli --help`
| Okta AWS Account Federation integration app ID | OKTA_AWS_ACCOUNT_FEDERATION_APP_ID | `--aws-acct-fed-app-id [value]` | See [AWS Account Federation integration app](#aws-account-federation-integration-app) |
| AWS IAM Identity Provider ARN | AWS_IAM_IDP | `--aws-iam-idp [value]` | The preferred IAM Identity Provider |
| AWS IAM Role ARN to assume | AWS_IAM_ROLE | `--aws-iam-role [value]` | The preferred IAM role for the given IAM Identity Provider |
| AWS Session Duration | AWS_SESSION_DURATION | `--session-duration [value]` | The lifetime, in seconds, of the AWS credentials. Must be between 60 and 43200. |
| Output format | FORMAT | `--format [value]` | Default is `env-var`. Options: `env-var` for output to environment variables, `aws-credentials` for output to AWS credentials file |
| Profile | PROFILE | `--profile [value]` | Default is `default` |
| Display QR Code | QR_CODE | `--qr-code` | `yes` if flag is present |
Expand Down
9 changes: 8 additions & 1 deletion cmd/root/root.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -87,6 +87,13 @@ func init() {
usage: "IAM Role ARN",
envVar: "AWS_IAM_ROLE",
},
{
name: "session-duration",
short: "s",
value: "3600",
usage: "Session duration for role.",
envVar: "AWS_SESSION_DURATION",
},
{
name: "profile",
short: "p",
Expand Down Expand Up @@ -124,7 +131,7 @@ func buildRootCommand() *cobra.Command {
Use: "okta-aws-cli",
Short: "okta-aws-cli - Okta federated identity for AWS CLI",
Long: `okta-aws-cli - Okta federated identity for AWS CLI

Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@tim-fitzgerald did you intend to indent the output one character? I think your editor got opinionated on formatting, adding extra white space to blank lines, adding tab characters, and throwing off the sprintf. I use VSCode and I've had to deal with this in HEREDOC-like formatting.

This occurs in cobra command Long value Long is the long message shown in the 'help <this-command>' output. and in resourceUsageTemplate()

Here is the after, note the indentation on help and the dangling % which I think is from a mismatched sprintf

After:
image

Before:
image

Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

go run cmd/okta-aws-cli/main.go --help

Okta authentication for federated identity providers in support of AWS CLI.
okta-aws-cli handles authentication to the IdP and token exchange with AWS STS
to collect a proper IAM role for the AWS CLI operator.`,
Expand Down
46 changes: 27 additions & 19 deletions internal/config/config.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -30,16 +30,17 @@ var Version = "0.0.3"

// Config A config object for the CLI
type Config struct {
OrgDomain string
OIDCAppID string
FedAppID string
AWSIAMIdP string
AWSIAMRole string
Format string
Profile string
QRCode bool
AWSCredentials string
HTTPClient *http.Client
OrgDomain string
OIDCAppID string
FedAppID string
AWSIAMIdP string
AWSIAMRole string
AWSSessionDuration int64
Format string
Profile string
QRCode bool
AWSCredentials string
HTTPClient *http.Client
}

// NewConfig Creates a new config gathering values in this order of precedence:
Expand All @@ -48,15 +49,16 @@ type Config struct {
// 3. .env file
func NewConfig() *Config {
cfg := Config{
OrgDomain: viper.GetString("org-domain"),
OIDCAppID: viper.GetString("oidc-client-id"),
FedAppID: viper.GetString("aws-acct-fed-app-id"),
AWSIAMIdP: viper.GetString("aws-iam-idp"),
AWSIAMRole: viper.GetString("aws-iam-role"),
Format: viper.GetString("format"),
Profile: viper.GetString("profile"),
QRCode: viper.GetBool("qr-code"),
AWSCredentials: viper.GetString("aws-credentials"),
OrgDomain: viper.GetString("org-domain"),
OIDCAppID: viper.GetString("oidc-client-id"),
FedAppID: viper.GetString("aws-acct-fed-app-id"),
AWSIAMIdP: viper.GetString("aws-iam-idp"),
AWSIAMRole: viper.GetString("aws-iam-role"),
AWSSessionDuration: viper.GetInt64("session-duration"),
Format: viper.GetString("format"),
Profile: viper.GetString("profile"),
QRCode: viper.GetBool("qr-code"),
AWSCredentials: viper.GetString("aws-credentials"),
}
if cfg.Format == "" {
cfg.Format = "env-var"
Expand All @@ -82,6 +84,9 @@ func NewConfig() *Config {
if cfg.AWSIAMRole == "" {
cfg.AWSIAMRole = viper.GetString("aws_iam_role")
}
if cfg.AWSSessionDuration == 0 {
cfg.AWSSessionDuration = viper.GetInt64("session_duration")
}
if !cfg.QRCode {
cfg.QRCode = viper.GetBool("qr_code")
}
Expand Down Expand Up @@ -110,6 +115,9 @@ func (c *Config) CheckConfig() error {
if c.FedAppID == "" {
errors = append(errors, " AWS Account Federation App ID value is not set")
}
if c.AWSSessionDuration < 60 || c.AWSSessionDuration > 43200 {
errors = append(errors, " AWS Session Duration must be between 60 and 43200")
}
if len(errors) > 0 {
return fmt.Errorf("%s", strings.Join(errors, "\n"))
}
Expand Down
2 changes: 1 addition & 1 deletion internal/sessiontoken/sessiontoken.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -199,7 +199,7 @@ func (s *SessionToken) fetchAWSCredentialWithSAMLRole(iar *idpAndRole, assertion
}
svc := sts.New(sess)
input := &sts.AssumeRoleWithSAMLInput{
DurationSeconds: aws.Int64(3600),
DurationSeconds: aws.Int64(s.config.AWSSessionDuration),
PrincipalArn: aws.String(iar.idp),
RoleArn: aws.String(iar.role),
SAMLAssertion: aws.String(assertion),
Expand Down