Nike-Inc / gimme-aws-creds

A CLI that utilizes Okta IdP via SAML to acquire temporary AWS credentials
Apache License 2.0
930 stars 263 forks source link

'acc-role' profile naming should support other delimiters #474

Open mjreed-wbd opened 2 months ago

mjreed-wbd commented 2 months ago

Expected Behavior

With cred_profile set to acc:role, generated profile names should be of the form $account:$role, likewise for acc/role, acc_role, or any other delimiter character.

Current Behavior

Only acc-role is special; any other accXrole string becomes the literal role name.

Possible Solution

Look for the pattern accXrole instead of the literal string 'acc-role' and if it matches use the character in position 3 as the delimiter when creating the role name.

Context

Before gimme-aws-creds we used a homegrown tool that created profiles of the form account:role. When we first switched to gimme-aws-creds, we needed some local customizations to support our security policies, so we just added the profile name support as part of our fork. Currently, the Nike version has incorporated the security fixes we need, so the only thing missing to let us abandon our fork and use the upstream version is the profile support. Unfortunately, we still have a lot of IaC with hard-coded profile names, which makes it a significant effort to simply adopt a new convention.

Your Environment