Support external-id with AWS STS:AssumeRole #5329
Closed
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Allow users to provide an external_id at assumerole creds generation time.
bpineau
force-pushed
the
simple-aws-sts-external-id
branch
from
d0baf92 to
b856573
Compare
|
Any update on this? I would very much appreciate being able to use vault with cross account roles with external IDs set. |
|
|
|
@joelthompson any thoughts on this rewrite? |
|
Hi @jefferai -- my thoughts are largely the same as in the other PR. Allowing arbitrary external IDs to be specified rather than generated by Vault has certain implications on the trust model of Vault. I still think reserving a prefix for generated IDs (rather than specified IDs) is probably the best compromise. |
|
This PR is presently identical to #5033. Thank you so much for leading the way on the rewrite here! Closing in favor of the other because it was opened first. Much appreciated, all the same. |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Support external id at sts:assumerole time.
https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_create_for-user_externalid.html
This is a rewrite, taking comments into account, of the larger patch set initialy sent in #5033
(also re-pushed in #5033 over the previous commit, but lost in the previous discussion).