search

tilfinltd / aws-extend-switch-roles

Extend your AWS IAM switching roles by Chrome extension, Firefox add-on, or Edge add-on
https://goo.gl/0QFjow
MIT License
1.31k stars 140 forks source link

Cannot See Target Roles when Logged into AWS via SSO (Identity Center) #299

Closed ismail44 closed 8 months ago

ismail44 commented 11 months ago

Describe the bug Cannot see "target roles" when logged into "base role" using AWS SSO.

To Reproduce Steps to reproduce the behavior:

  1. Update config with a base account that is an AWS SSO Permission Set
  2. Log into AWS using SSO and that permission set in the base account
  3. Click plugin to see roles that can be assumed
[base1]
aws_account_id = XXXXXXXXXXXXXX
role_name = some_role
[base2-sso]
aws_account_id = XXXXXXXXXXXX
role_name = some_permission_set
[base2-assumeable-role]
source_profile = base2-sso
role_arn = arn:aws:iam::XXXXXXXXXX:role/some_assumeable_role

Expected behavior I would expect that by logging into the role identified by base2-sso, I would see base2-assumeable-role in my dropdown.

Environment

tilfin commented 11 months ago

How is the Settings check list set up? Uncheck them all and try it.

Does your username start with AWSReservedSSO_ after logging into AWS MC?

ismail44 commented 11 months ago

Thanks for the reply.

All boxes are unchecked... and the permission set I choose is:

AWSReservedSSO_(rolename)_ca8fexxxxxxxx/{my email}

tilfin commented 11 months ago

@ismail44 Just to confirm, is the _ included in the ca8fexxxxxxxxxx ? If so, it may cause this problem.

tilfin commented 8 months ago

If account alias is set as shown below, you must also define aws_account_alias.

[base-sso]
aws_account_id = 000011112222
aws_account_alias = company
role_name = some_permission_set
ismail44 commented 8 months ago

That worked like a charm!!! Thanks.

On Oct 24, 2023, at 8:02 AM, Toshimitsu Takahashi @.***> wrote:

If account alias is set as shown below, you must also define aws_account_alias.

https://user-images.githubusercontent.com/519017/277650102-4a6ca228-b477-4614-b05f-bb02dc21cec5.png [base-sso] aws_account_id = 000011112222 aws_account_alias = company role_name = some_permission_set — Reply to this email directly, view it on GitHub https://github.com/tilfinltd/aws-extend-switch-roles/issues/299#issuecomment-1777073070, or unsubscribe https://github.com/notifications/unsubscribe-auth/AALKBT6ILQCTUWJAC4PMSYDYA6U5RAVCNFSM6AAAAAA3AHZ472VHI2DSMVQWIX3LMV43OSLTON2WKQ3PNVWWK3TUHMYTONZXGA3TGMBXGA. You are receiving this because you were mentioned.