search

common-fate / granted

The easiest way to access your cloud.
https://granted.dev
MIT License
955 stars 90 forks source link

Only enable auto-refresh when all necessary fields exist in .aws/config #652

Open congyue-chewie opened 2 months ago

congyue-chewie commented 2 months ago

This issue was from this slack discussion.

If the .aws/config was previously populated by other third-party aws cli, it may confuse the granted/assume and cause the AWS access not being set up properly. e.g. If the .aws/config was populated by aws-sso-util:

❯ cat ~/.aws/config
[profile login]
sso_start_url = https://xxx.awsapps.com/start
sso_region = us-west-2

[profile example_profile]
sso_start_url = https://xxx.awsapps.com/start
sso_region = us-west-2
sso_account_name = example_profile
sso_account_id = xxx
sso_role_name = xxx
region = us-west-2
credential_process = aws-sso-util credential-process --profile example_profile
sso_auto_populated = true

In recent version of granted, if it detects credential_process field like above, it would enable the auto-refresh feature and only set part of the environment variables. However the rest of the fields above are not compatible with granted.

Suggestion: granted can check if all necessary fields exist in .aws/config(instead of credential_process only) before enabling the auto refresh ? So that users with above config file can still run granted in “compatible” mode?

datfinesoul commented 1 month ago

Would it make sense to have the auto refresh itself be toggle in the config file somewhere. Or is that already something that's done via not having granted_sso_registration_scopes present in the ~/.aws/config file?