aws / aws/aws-cli

AWS CLI does not propagate session tags through profiles due to lack of TransitiveTagKeys support

Open
#8,953 3 comments 1 reaction 0 assignees View on GitHub
configuration feature-request p2
Dominant language
Python
Stars
17.3k
Forks
4.6k
Avg merge
1d 2h
Merged PRs (30d)
13

Description

### Describe the feature

Adding an option to the `[profile ...]` section of the config file, that allows the use of transitive tags during assume role chains.

```ini
[profile sso-user]
sso_session = my-sso-session
source_profile = sso-user-access
role_arn = arn:aws:iam::123456789012:role/SSOUserRole
region = us-east-1
transitive_tags = my_transitive_tag # <- new option
```

### Use Case

When calling any command in the CLI with the `--profile` option, the CLI automatically runs an `assume_role` chain to get credentials for the target profile.

To enable the use of [ABAC](https://docs.aws.amazon.com/IAM/latest/UserGuide/introduction_attribute-based-access-control.html) policies via the CLI, one needs to be able to specify what tags need to be carried through the assume role chain.

### Proposed Solution

_No response_

### Other Information

_No response_

### Acknowledgements

- [X] I may be able to implement this feature request
- [x] This feature might incur a breaking change

### CLI version used

aws-cli/2.17.24 Python

### Environment details (OS name and version, etc.)

3.11.9 Darwin/22.6.0 source/arm64

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.