common-fate / granted

The easiest way to access your cloud.
https://granted.dev
MIT License
1.06k stars 94 forks source link

Chained roles do not work with aws-azure-login #558

Closed chrnorm closed 10 months ago

chrnorm commented 10 months ago

Reported in our Community Slack.

To reproduce, set up profiles as follows:

[profile sso1]
azure_tenant_id = -------------------
azure_app_id_uri = -------------------
azure_default_duration_hours = 10
region = eu-west-2
azure_default_username = ------@------.com

[profile sso2]
azure_tenant_id = -------------------
azure_app_id_uri = -------------------
azure_default_duration_hours = 10
region = eu-west-2
azure_default_username = ------@------.com

[profile customer1]
role_arn = arn:aws:iam::012345678901:role/rolename
source_profile = sso1

[profile customer2]
role_arn = arn:aws:iam::987654321098:role/rolename
source_profile = sso2

assume sso1 will work just fine, but assume customer1 returns an error Profile 'customer1' is not configured properly.. This is because Granted is ignoring the source_profile fields with aws-azure-login.

Log output:

> assume --verbose sso1
[DEBUG] profile registry not configured. Skipping auto sync.
[DEBUG] process args    execFlag:       osargs:[assumego,--verbose,ans] c.args:[sso1]
[DEBUG] processed profile namesso1
[DEBUG] exec config:<nil>
[DEBUG] skipping profile with name sso1 - profile already defined in config
[DEBUG] skipping profile with name sso2 - profile already defined in config
Logging in with profile 'sso1'...
Using AWS SAML endpoint https://signin.aws.amazon.com/saml
Assuming role arn:aws:iam::123456789012:role/rolename
[✔] [sso1](eu-west-2) session credentials ready

> assume --verbose customer1
[DEBUG] profile registry not configured. Skipping auto sync.
[DEBUG] process args    execFlag:       osargs:[assumego,--verbose,mpc-main-prd]        c.args:[customer1]
[DEBUG] processed profile namecustomer1
[DEBUG] exec config:<nil>
[DEBUG] skipping profile with name sso1 - profile already defined in config
[DEBUG] skipping profile with name sso2 - profile already defined in config
Profile 'customer1' is not configured properly.