common-fate / granted

The easiest way to access your cloud.
https://granted.dev
MIT License
955 stars 90 forks source link

Credentials are not exported when using `--sso` flags with a JIT backend #676

Open chrnorm opened 4 weeks ago

chrnorm commented 4 weeks ago

When using Granted with Common Fate, when running the following command:

. assume --sso --sso-start-url https://example.awsapps.com/start --sso-region eu-west-1 --account-id 000000000000 --role-name MyRole

AWS_* credentials are not exported in the shell. Re-running the command a second time does export the credentials.

We need to handling for the --sso flags in Granted so that this command works the first time rather than requiring multiple runs.

Example Granted config to reproduce this issue:

$ cat ~/.granted/config 
DefaultBrowser = "CHROMIUM"
CustomBrowserPath = "/usr/bin/chromium-browser"
CustomSSOBrowserPath = ""
Ordering = ""
ExportCredentialSuffix = ""

An additional note: retrying the command immediately causes it to fail (this is because the account assignment has not yet completed provisioning). Retrying again after ~5s works.