[aws-vault] Simultaneous support for aws-vault v4 and v5 #579
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
leb4r
pushed a commit
that referenced
this pull request
Jan 25, 2022
Co-authored-by: osterman <[email protected]>
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
what
cloudposse/packageswhy
aws-vaultreleased a major upgrade, going from version 4 to version 5, and in the process, seems to have broken support for long-lived assumed roles. See 532 and 552 for example issues. However, due to breaking changes in v5, Geodesic dropped support for v4 in Update to helm 3, aws-vault 5 #546, making it impossible for people to revert to the working version 4. This PR restores support for v4 while maintaining support for v5. See further details below.further information about
aws-vaultWhile
aws-vaultdefined some environment variables to be used for configuring its behavior, Geodesic preferred to use its own variables starting withAWS_VAULTto avoid confusion with official AWS SDK configuration variables. In the past, these variables were converted to command-line arguments in order to keep theaws-vaultvariables out of the environment entirely.With this PR, we still suggest setting the AWS_VAULT_* variables to configure
aws-vault:AWS_VAULT_ASSUME_ROLE_TTL: Expiration time for the AssumeRole credentialsAWS_VAULT_SESSION_TTL: Length of time before you have to login againAWS_VAULT_CHAINED_SESSION_TOKEN_TTL: Expiration time for the GetSessionToken credentials when chaining profiles (aws-vaultversion 5 only)If you set these variables and also have not set
AWS_VAULT_ENABLED=false, then these variables will be converted to the appropriate environment variables for the version ofaws-vaultyou have installed.As has been the case for some time, Geodesic sets
and as of this PR,
AWS_VAULT_CHAINED_SESSION_TOKEN_TTLdefaults to the value ofAWS_VAULT_SESSION_TTL.If you want to use
aws-vaultversion 4, you can add this line to your Dockerfile: