aws / aws/aws-cli

Option to preserve `role_session_name` when chaining roles

Open
#8,797 3 comments 1 reaction 0 assignees View on GitHub
assume-role configuration feature-request p2 sso
Dominant language
Python
Stars
17.3k
Forks
4.6k
Avg merge
1d 2h
Merged PRs (30d)
13

Description

### Describe the feature

Currently, if no `role_session_name` is set it's being by set to default value like `botocore-session-xxxxxxx`.
However, would be great to have an option to preserve existing `role_session_name` when chaining roles.

### Use Case

When using IAM Identity Center initially created session has `role_session_name` automatically set to the user name like `john.doe@example.com`. However on subsequent `AssumeRole` calls, initial session name is being lost and replaced with `botocore-session-xxxxxxx`. I would like to have an option to preserve original session name when chaining roles.

### Proposed Solution

Let's say following configuration is used:

```diff
[profile sso]
sso_start_url = https://test.awsapps.com/start
sso_region = us-east-1
sso_account_id = 123456789012
sso_role_name = SSORole
region = us-east-1

[profile operator]
role_arn = arn:aws:iam::123456789012:role/operator-role
region = us-east-1
source_profile = sso
+preserve_source_role_session_name = true
```

### Other Information

_No response_

### Acknowledgements

- [ ] I may be able to implement this feature request
- [ ] This feature might incur a breaking change

### CLI version used

aws-cli/2.17.11

### Environment details (OS name and version, etc.)

Darwin/23.5.0

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.