aws / aws/aws-sdk-java-v2

V2 SDK does not support `duration_seconds` for the Assume role credential provider when configured via shared AWS config file

Open
#5,695 1 comment 0 reactions 0 assignees View on GitHub
bug p2
Dominant language
Java
Stars
2.6k
Forks
1k
Avg merge
2d 9h
Merged PRs (30d)
51

Description

### Describe the bug

In my shared AWS config file, I set configured it to trigger the SDK to use the `StsAssumeRoleCredentials` provider. I used the following settings in the config file:

```
[default]
role_arn = arn:aws:iam::111122223333:role/s3-listbuckets-only-role
duration_seconds = 900
role_session_name = test-temp-session
source_profile = main-profile
```
`main-profile` settings not shown, but it configures an sso session setup to use IdC.

In code, with wire logging enabled, I create an S3 client `S3Client s3Client = S3Client.create();`.

I see the following response that lists the expiration time (``):
```
2024-11-01 17:00:48 [main] DEBUG org.apache.http.wire:73 - http-outgoing-1 << "HTTP/1.1 200 OK[\r][\n]"
2024-11-01 17:00:48 [main] DEBUG org.apache.http.wire:73 - http-outgoing-1 << "x-amzn-RequestId: fda3def1-b162-46e8-91dc-d590bc9feed8[\r][\n]"
2024-11-01 17:00:48 [main] DEBUG org.apache.http.wire:73 - http-outgoing-1 << "Content-Type: text/xml[\r][\n]"
2024-11-01 17:00:48 [main] DEBUG org.apache.http.wire:73 - http-outgoing-1 << "Content-Length: 1477[\r][\n]"
2024-11-01 17:00:48 [main] DEBUG org.apache.http.wire:73 - http-outgoing-1 << "Date: Fri, 01 Nov 2024 21:00:47 GMT[\r][\n]"
2024-11-01 17:00:48 [main] DEBUG org.apache.http.wire:73 - http-outgoing-1 << "[\r][\n]"
2024-11-01 17:00:48 [main] DEBUG org.apache.http.wire:73 - http-outgoing-1 << "[\n]"
2024-11-01 17:00:48 [main] DEBUG org.apache.http.wire:73 - http-outgoing-1 << " [\n]"
2024-11-01 17:00:48 [main] DEBUG org.apache.http.wire:73 - http-outgoing-1 << " [\n]"
2024-11-01 17:00:48 [main] DEBUG org.apache.http.wire:73 - http-outgoing-1 << " AROATKON37RG6VSFDTY4F:test-temp-session[\n]"
2024-11-01 17:00:48 [main] DEBUG org.apache.http.wire:73 - http-outgoing-1 << " arn:aws:sts::111122223333:assumed-role/s3-listbuckets-only-role/test-temp-session[\n]"
2024-11-01 17:00:48 [main] DEBUG org.apache.http.wire:73 - http-outgoing-1 << " [\n]"
2024-11-01 17:00:48 [main] DEBUG org.apache.http.wire:73 - http-outgoing-1 << " [\n]"
2024-11-01 17:00:48 [main] DEBUG org.apache.http.wire:73 - http-outgoing-1 << " xxx[\n]"
2024-11-01 17:00:48 [main] DEBUG org.apache.http.wire:73 - http-outgoing-1 << " xxx[\n]"
2024-11-01 17:00:48 [main] DEBUG org.apache.http.wire:73 - http-outgoing-1 << " xxx[\n]"
2024-11-01 17:00:48 [main] DEBUG org.apache.http.wire:73 - http-outgoing-1 << " 2024-11-01T22:00:48Z[\n]"
2024-11-01 17:00:48 [main] DEBUG org.apache.http.wire:73 - http-outgoing-1 << " [\n]"
2024-11-01 17:00:48 [main] DEBUG org.apache.http.wire:73 - http-outgoing-1 << " [\n]"
2024-11-01 17:00:48 [main] DEBUG org.apache.http.wire:73 - http-outgoing-1 << " [\n]"
2024-11-01 17:00:48 [main] DEBUG org.apache.http.wire:73 - http-outgoing-1 << " fda3def1-b162-46e8-91dc-d590bc9feed8[\n]"
2024-11-01 17:00:48 [main] DEBUG org.apache.http.wire:73 - http-outgoing-1 << " [\n]"
2024-11-01 17:00:48 [main] DEBUG org.apache.http.wire:73 - http-outgoing-1 << "[\n]"
```
No matter what I set the `duration_seconds` value to, the expiration is always 1 hour (the default) after the initial call to STS.

### Regression Issue

- [ ] Select this option if this issue appears to be a regression.

### Expected Behavior

The SDK should honor the `duration_seconds` provided in the config file. This setting is not listed as an exception in the SDK reference (https://docs.aws.amazon.com/sdkref/latest/guide/feature-assume-role-credentials.html#assume-role-sdk-compat)

### Current Behavior

The SDK ignored the `duration_seconds` provided in the config file and used the default value (3600 seconds).

### Reproduction Steps

See earlier.

### Possible Solution

_No response_

### Additional Information/Context

_No response_

### AWS Java SDK version used

2.29.5

### JDK version used

17

### Operating System and version

Mac - Sonoma 14.5

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.