jenkinsci / jenkinsci/aws-credentials-plugin
Respect `roleSessionName` even when `roleArn` is absent
- Dominant language
- Java
- Stars
- 30
- Forks
- 81
- PR merge metrics
- No merged PRs in 30d
Description
### What feature do you want to see added?
#### Background
Currently, `roleSessionName` is respected only when `roleArn` is set.
Session naming takes place in `assumeRoleProvider()`:
https://github.com/jenkinsci/aws-credentials-plugin/blob/8422af384cd998e5d56b25bd8802aa4385d799d8/src/main/java/com/cloudbees/jenkins/plugins/awscredentials/AmazonWebServicesCredentialsBinding.java#L161
However, `assumeRoleProvider()` is called only when `roleArn` is non-empty:
https://github.com/jenkinsci/aws-credentials-plugin/blob/8422af384cd998e5d56b25bd8802aa4385d799d8/src/main/java/com/cloudbees/jenkins/plugins/awscredentials/AmazonWebServicesCredentialsBinding.java#L138-L139
I'm assuming it is an expected behavior, because usage examples in README mention `roleSessionName` only once and only together with the `roleArn`.
#### Feature request
I want to be able to name the session via `roleSessionName` without explicitly setting `roleArn`, while having the role ARN specified in the credentials.
```groovy
withCredentials([[
$class: 'AmazonWebServicesCredentialsBinding',
credentialsId: 'my_aws_credential',
roleSessionName: 'mySessionName',
]]) {
```
#### What I tried
1. Tried setting `roleSessionName` without `roleArn` - `roleSessionName` was ignored because of the above mentioned reasons.
2. Tried setting `roleArn` and `roleSessionName` - plugin was trying to assume the same role twice:
> Also: hudson.remoting.ProxyException: org.jenkinsci.plugins.workflow.actions.ErrorAction$ErrorId: 33f4eaec-1989-4b93-b3e8-cd76249c84bb
hudson.remoting.ProxyException: software.amazon.awssdk.services.sts.model.StsException: User: arn:aws:sts::123456789012:assumed-role/jenkins/Jenkins is not authorized to perform: sts:AssumeRole on resource: arn:aws:iam::123456789012:role/jenkins (Service: Sts, Status Code: 403, Request ID: c65970a5-5c37-4cb5-815c-d0313eacd13e) (SDK Attempt Count: 1)
3. Tried setting `roleArn` and `roleSessionName`, but removing `credentialsId`, because credentials contained only the role ARN:
> Also: org.jenkinsci.plugins.workflow.actions.ErrorAction$ErrorId: 6a1b8b49-8c75-48da-9fd4-b94a0c6666de
java.lang.NullPointerException
### Upstream changes
_No response_
### Are you interested in contributing this feature?
Yes.
Contributor guide
Research direction
Start in src/main/java/com/cloudbees/jenkins/plugins/awscredentials/AmazonWebServicesCredentialsBinding.java at the referenced lines 138-139 and 161, and compare the README roleSessionName examples. Trace how credentials containing a role ARN are handled when roleArn is absent; done means roleSessionName is honored without a second role assumption or a null credentials error.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- aws, java
- Domain
- authentication, cloud
- Issue type
- Feature
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Quiet
- Clarity
- Mostly clear
- Newbie friendliness
- 68/100