Skip to content

feat: Allow assume role chaining with federated users (source identity and session tags) #5359

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
wants to merge 9 commits into
base: mainline
Choose a base branch
from
Open

feat: Allow assume role chaining with federated users (source identity and session tags) #5359

Changes from 1 commit
Commits
Show all changes
9 commits
Select commit Hold shift + click to select a range
7829397
Allow assume role chaining with federated users (source identity and …
FlorianSW Oct 9, 2023
6549671
Merge branch 'mainline' of github.com:aws/copilot-cli into issues/5358
FlorianSW Oct 24, 2023
3075aa7
Make additional assume role permissions in envmanager role configurable
FlorianSW Oct 25, 2023
01ec03b
missing integration tests
FlorianSW Oct 26, 2023
8a77a4c
fix codestyle :)
FlorianSW Oct 26, 2023
179975b
adjust another integration test for new default env manifest yml
FlorianSW Nov 1, 2023
dd08f9d
Merge branch 'mainline' of github.com:aws/copilot-cli into issues/5358
FlorianSW Nov 1, 2023
af271ee
fix typo
FlorianSW Nov 1, 2023
bfec751
add new permission from merging remote mainline
FlorianSW Nov 1, 2023
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
5 changes: 4 additions & 1 deletion internal/pkg/template/templates/environment/partials/environment-manager-role.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -12,7 +12,10 @@ EnvironmentManagerRole:
- Effect: Allow
Principal:
AWS: !Sub ${ToolsAccountPrincipalARN}
Action: sts:AssumeRole
Action:
- sts:AssumeRole
- sts:SetSourceIdentity
- stsTagSession
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change
- stsTagSession
- sts: TagSession

{{- if .PermissionsBoundary}}
PermissionsBoundary: !Sub 'arn:${AWS::Partition}:iam::${AWS::AccountId}:policy/{{.PermissionsBoundary}}'
{{- end}}
Expand Down