cdklabs / cdklabs/cdk-pipelines-github

Will session tagging be available?

Open
#152 1 comment 0 reactions 0 assignees View on GitHub
effort-small feature-request p2
Dominant language
TypeScript
Stars
384
Forks
45
Avg merge
1d 1h
Merged PRs (30d)
4

Description

As I review aws-actions/configure-aws-credentials@v1 I see that it supports [session tagging.][1] And when I review the ['private' implementation][2] I get the sense that session tagging was not enabled on purpose. However, I wonder if there is the possibility of splitting things up a little bit so that on the first assumed role (OIDC) that the session tagging can be enabled and on the subsequent CDK related roles it is not required.

This is because the first assumed role (OIDC) requires conditions that perhaps are best evaluated using the session tags. And the CDK related roles are not best situated, as they are not OIDC aware, nor should they be. Without the use of session tags on the OIDC role it is significantly difficult to make anything more complex than a simple example work. E.g., if you have 3+ github ORGs and 1500+ repos then it is difficult to make one OIDC role per account work well. If however, the session tags are present, then it is fairly easy to make a single role that can match the expected conditions.

Thoughts?

[1]: https://github.com/aws-actions/configure-aws-credentials/blob/1ca0e74a85c3235766beb2e82e30dd3e84dd1441/action.yml#L51-L53
[2]: https://github.com/cdklabs/cdk-pipelines-github/blob/94c9d7f7f84268ee173f6a0255812660fd56198c/src/private/aws-credentials.ts#L71-L73

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.