jenkinsci / jenkinsci/aws-credentials-plugin

Respect `roleSessionName` even when `roleArn` is absent

Open
#332 0 comments 2 reactions 0 assignees View on GitHub
Dominant language
Java
Stars
30
Forks
81
PR merge metrics
No merged PRs in 30d

Description

### What feature do you want to see added?

#### Background

Currently, `roleSessionName` is respected only when `roleArn` is set.

Session naming takes place in `assumeRoleProvider()`:
https://github.com/jenkinsci/aws-credentials-plugin/blob/8422af384cd998e5d56b25bd8802aa4385d799d8/src/main/java/com/cloudbees/jenkins/plugins/awscredentials/AmazonWebServicesCredentialsBinding.java#L161
However, `assumeRoleProvider()` is called only when `roleArn` is non-empty:
https://github.com/jenkinsci/aws-credentials-plugin/blob/8422af384cd998e5d56b25bd8802aa4385d799d8/src/main/java/com/cloudbees/jenkins/plugins/awscredentials/AmazonWebServicesCredentialsBinding.java#L138-L139

I'm assuming it is an expected behavior, because usage examples in README mention `roleSessionName` only once and only together with the `roleArn`.

#### Feature request

I want to be able to name the session via `roleSessionName` without explicitly setting `roleArn`, while having the role ARN specified in the credentials.

```groovy
withCredentials([[
$class: 'AmazonWebServicesCredentialsBinding',
credentialsId: 'my_aws_credential',
roleSessionName: 'mySessionName',
]]) {
```

#### What I tried

1. Tried setting `roleSessionName` without `roleArn` - `roleSessionName` was ignored because of the above mentioned reasons.
2. Tried setting `roleArn` and `roleSessionName` - plugin was trying to assume the same role twice:
> Also: hudson.remoting.ProxyException: org.jenkinsci.plugins.workflow.actions.ErrorAction$ErrorId: 33f4eaec-1989-4b93-b3e8-cd76249c84bb
hudson.remoting.ProxyException: software.amazon.awssdk.services.sts.model.StsException: User: arn:aws:sts::123456789012:assumed-role/jenkins/Jenkins is not authorized to perform: sts:AssumeRole on resource: arn:aws:iam::123456789012:role/jenkins (Service: Sts, Status Code: 403, Request ID: c65970a5-5c37-4cb5-815c-d0313eacd13e) (SDK Attempt Count: 1)
3. Tried setting `roleArn` and `roleSessionName`, but removing `credentialsId`, because credentials contained only the role ARN:
> Also: org.jenkinsci.plugins.workflow.actions.ErrorAction$ErrorId: 6a1b8b49-8c75-48da-9fd4-b94a0c6666de
java.lang.NullPointerException

### Upstream changes

_No response_

### Are you interested in contributing this feature?

Yes.

Contributor guide

Open the contributing guide

Research direction

Start in src/main/java/com/cloudbees/jenkins/plugins/awscredentials/AmazonWebServicesCredentialsBinding.java at the referenced lines 138-139 and 161, and compare the README roleSessionName examples. Trace how credentials containing a role ARN are handled when roleArn is absent; done means roleSessionName is honored without a second role assumption or a null credentials error.

Written by the indexing model from the issue text.

Assessment

Tech stack
aws, java
Domain
authentication, cloud
Issue type
Feature
Difficulty
3/5
Estimated time
1-2 days
Activity status
Quiet
Clarity
Mostly clear
Newbie friendliness
68/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.