CircleCI-Public / CircleCI-Public/aws-cli-orb

Add Support for Session Tags in aws-cli/setup

Open
#219 1 comment 1 reaction 0 assignees View on GitHub
enhancement
Dominant language
Shell
Stars
61
Forks
62
Avg merge
24m
Merged PRs (30d)
1

Description

I'm currently using the orb to assume AWS roles via OIDC in our pipeline. However, the orb does not support passing session tags during role assumption, which is crucial for our security model.

Background:
Our security policies enforce dynamic IAM restrictions based on session tags (e.g., project identifiers) that must be attached at the time of role assumption via sts:AssumeRoleWithWebIdentity. Since the orb's aws-cli/setup command doesn't support session tags, even if I try to export session tag values as environment variables after the role has been assumed, they are not included in the temporary credentials. As a result, dynamic policy evaluation using these session tags (e.g., aws:PrincipalTag/project_id) does not work, and sessions can perform operations even if the project is not allowed by our policy.

Contributor guide

No contributing guide indexed for this repository

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.