AWS CLI does not propagate session tags through profiles due to lack of TransitiveTagKeys support
- Dominant language
- Python
- Stars
- 17.3k
- Forks
- 4.6k
- Avg merge
- 1d 2h
- Merged PRs (30d)
- 13
Description
### Describe the feature
Adding an option to the `[profile ...]` section of the config file, that allows the use of transitive tags during assume role chains.
```ini
[profile sso-user]
sso_session = my-sso-session
source_profile = sso-user-access
role_arn = arn:aws:iam::123456789012:role/SSOUserRole
region = us-east-1
transitive_tags = my_transitive_tag # <- new option
```
### Use Case
When calling any command in the CLI with the `--profile` option, the CLI automatically runs an `assume_role` chain to get credentials for the target profile.
To enable the use of [ABAC](https://docs.aws.amazon.com/IAM/latest/UserGuide/introduction_attribute-based-access-control.html) policies via the CLI, one needs to be able to specify what tags need to be carried through the assume role chain.
### Proposed Solution
_No response_
### Other Information
_No response_
### Acknowledgements
- [X] I may be able to implement this feature request
- [x] This feature might incur a breaking change
### CLI version used
aws-cli/2.17.24 Python
### Environment details (OS name and version, etc.)
3.11.9 Darwin/22.6.0 source/arm64
Contributor guide
Assessment
This issue has not been assessed yet.