Support a custom Session Name for `aws eks get-token` command
- Dominant language
- Python
- Stars
- 17.3k
- Forks
- 4.6k
- Avg merge
- 1d 2h
- Merged PRs (30d)
- 13
Description
### Describe the feature
Add an option `--role-session-name` to be used in conjunction with the `--role-arn` flag for the [`aws eks get-token`](https://awscli.amazonaws.com/v2/documentation/api/latest/reference/eks/get-token.html) command.
This flag would override the [currently hard-coded role session name](https://github.com/aws/aws-cli/blob/c8e3002ced34a77f52cb31df9298b0129cd95ebd/awscli/customizations/eks/get_token.py#L257) of `EKSGetTokenAuth` if provided.
### Use Case
Currently our organization uses the open source [Leapp](https://github.com/Noovolari/leapp) app to manage our role chaining and sessions. We are able to configure named sessions when authenticating to our EKS cluster, which allows us to identify authenticated users in the cluster for auditing and monitoring purposes.
Leapp's [parent company has shut down](https://blog.leapp.cloud/noovolari-has-officially-come-to-an-end) and on top of that, we are exploring a new development platform where the Leapp desktop app is not supported.
One simple fix to this specific problem is supporting a custom role session name for the `aws eks get-token`, which is used in the `~/.kube/config` file that is generated by `aws eks update-kubeconfig` command.
A snippet of the `~/.kube/config` file might look like this below. Note fields marked with `XXXXXXXXXXX` are redacted.
```yaml
apiVersion: v1
kind: Config
clusters:
- cluster:
certificate-authority-data: XXXXXXXXXXX
server: https://XXXXXXXXXXX.gr7.us-east-1.eks.amazonaws.com:443
name: arn:aws:eks:us-east-1:123456789012:cluster/production
contexts:
- context:
cluster: arn:aws:eks:us-east-1:123456789012:cluster/production
user: prod-access
name: prod-admin
users:
- name: prod-access
user:
exec:
apiVersion: client.authentication.k8s.io/v1beta1
args:
- --region
- us-east-1
- eks
- get-token
- --cluster-name
- staging
- --output
- json
- --role-arn
- arn:aws:iam::123456789012:role/eks-admin
- --role-session-name
- eks-admin-my-name-here@company.com
command: aws
```
Currently, without being able specify a role session name for `aws eks get-token`, the identity information looks like this.
```text
$ kubectl auth whoami
ATTRIBUTE VALUE
Username company-editor
UID aws-iam-authenticator:123456789012:XXXXXXXXXXX
Groups [company-editors system:authenticated]
Extra: accessKeyId [XXXXXXXXXX]
Extra: arn [arn:aws:sts::123456789012:assumed-role/company-dev-writer/EKSGetTokenAuth]
Extra: canonicalArn [arn:aws:iam::851928862626:role/company-dev-writer]
Extra: principalId [XXXXXXXXXX]
Extra: sessionName [EKSGetTokenAuth]
Extra: sigs.k8s.io/aws-iam-authenticator/principalId [XXXXXXXXXX]
```
Note the `Extra` field `sessionName` is set to `EKSGetTokenAuth`.
### Proposed Solution
Update the [`STSClientFactory`](https://github.com/aws/aws-cli/blob/c8e3002ced34a77f52cb31df9298b0129cd95ebd/awscli/customizations/eks/get_token.py#L239) class [method `_get_role_credentials`](https://github.com/aws/aws-cli/blob/c8e3002ced34a77f52cb31df9298b0129cd95ebd/awscli/customizations/eks/get_token.py#L254) to add support for a `role_session_name` parameter. If provided, it would override the default of `EKSGetTokenAuth`.
Add `role-session-name` to the [`ARG_TABLE`](https://github.com/aws/aws-cli/blob/c8e3002ced34a77f52cb31df9298b0129cd95ebd/awscli/customizations/eks/get_token.py#L79) for this command.
As far as the python code changes, they seem fairly small and straight forward, but I'm not familiar with the testing suite and so I am requesting this feature in the event that an existing maintainer can implement it (with tests) faster than I can.
### Other Information
_No response_
### Acknowledgements
- [X] I may be able to implement this feature request
- [ ] This feature might incur a breaking change
### CLI version used
aws-cli/2.18.0 Python/3.12.6 Linux/6.5.0-1025-azure exe/x86_64.ubuntu.20
### Environment details (OS name and version, etc.)
GitHub Codespace (Linux codespaces-9d6cfb 6.5.0-1025-azure #26~22.04.1-Ubuntu SMP Thu Jul 11 22:33:04 UTC 2024 x86_64 x86_64 x86_64 GNU/Linux)
Contributor guide
Assessment
This issue has not been assessed yet.