search

fugue / credstash

A little utility for managing credentials in the cloud
Apache License 2.0
2.06k stars 215 forks source link

Update get_session() to allow using only profile_name and no access/secret keys #277

Closed eisjcormier closed 4 years ago

eisjcormier commented 4 years ago

We use credstash on our Jenkins workers. The workers use Role based authentication, we have only a ~/.aws/config file, no credentials. When we upgraded to v1.16.2 we started seeing errors:

An error occurred (AccessDeniedException) when calling the Query operation: User: arn:aws:sts::111111111:assumed-role/RoleNameOfDefaultProfile/botocore-session-333333333 is not authorized to perform: dynamodb:Query on resource: arn:aws:dynamodb:us-east-1:111111111:table/secret-credential-store

credstash was not using the profile we passed in with the -p parameter. After debugging, I discovered it was because boto3.Session() was being called with no parameters and therefore defaulted to the "default" profile.

eisjcormier commented 4 years ago

Hey @mike-luminal, I don't see a way to add reviewers to a PR but I noticed you were active on some other recent PRs. Do you need anything else from me for this PR?

mike-luminal commented 4 years ago

Hey @mike-luminal, I don't see a way to add reviewers to a PR but I noticed you were active on some other recent PRs. Do you need anything else from me for this PR?

Hey @eisjcormier, nope, this is good. I will take a look on the weekend. Thanks for your contribution!

eisjcormier commented 4 years ago

Cool. Thanks man!