Sending DurationSeconds in assumeRole request in SharedIniFileCredent…

…ials (#2909) * Sending DurationSeconds in assumeRole request in SharedIniFileCredentials * Update changelog to feature --------- Co-authored-by: Minh Nguyen <[email protected]>
aws · Jul 5, 2023 · dd0206f · dd0206f
1 parent 0b4dc9d
commit dd0206f
Show file tree

Hide file tree

Showing 3 changed files with 22 additions and 0 deletions.
diff --git a/.changes/next-release/feature-SharedIniFileCredentials-a7143a9b.json b/.changes/next-release/feature-SharedIniFileCredentials-a7143a9b.json
@@ -0,0 +1,5 @@
+{
+ "type": "feature",
+ "category": "SharedIniFileCredentials",
+ "description": "Make duration_seconds work for chained profiles"
+}
diff --git a/lib/credentials/shared_ini_file_credentials.js b/lib/credentials/shared_ini_file_credentials.js
@@ -192,6 +192,7 @@ AWS.SharedIniFileCredentials = AWS.util.inherit(AWS.Credentials, {
  var externalId = roleProfile['external_id'];
  var mfaSerial = roleProfile['mfa_serial'];
  var sourceProfileName = roleProfile['source_profile'];
+ var durationSeconds = parseInt(roleProfile['duration_seconds'], 10) || undefined;
 
  // From experimentation, the following behavior mimics the AWS CLI:
  //
@@ -246,6 +247,7 @@ AWS.SharedIniFileCredentials = AWS.util.inherit(AWS.Credentials, {
  });
 
  var roleParams = {
+ DurationSeconds: durationSeconds,
  RoleArn: roleArn,
  RoleSessionName: roleSessionName || 'aws-sdk-js-' + Date.now()
  };

diff --git a/test/credentials.spec.js b/test/credentials.spec.js
@@ -1308,6 +1308,21 @@ const exp = require('constants');
  return done();
  });
  });
+ it('will use duration_seconds for assume role when provided', function(done) {
+ var creds, mock, assumeRoleSpy;
+ mock = '[default]\nrole_arn = arn\nsource_profile = foo_base\nduration_seconds = 7200\n'
+ + '[foo_base]\naws_access_key_id = baseKey\naws_secret_access_key = baseSecret\n';
+ helpers.spyOn(AWS.util, 'readFileSync').andReturn(mock);
+ helpers.mockHttpResponse(200, {}, '<AssumeRoleResponse xmlns="https://sts.amazonaws.com/doc/2011-06-15/">\n <AssumeRoleResult>\n <Credentials>\n <AccessKeyId>KEY</AccessKeyId>\n <SecretAccessKey>SECRET</SecretAccessKey>\n <SessionToken>TOKEN</SessionToken>\n <Expiration>1970-01-01T00:00:00.000Z</Expiration>\n </Credentials>\n </AssumeRoleResult>\n</AssumeRoleResponse>');
+ var STSPrototype = (new STS()).constructor.prototype;
+ creds = new AWS.SharedIniFileCredentials();
+ assumeRoleSpy = helpers.spyOn(STSPrototype, 'assumeRole').andCallThrough();
+ return creds.refresh(function(err) {
+ expect(assumeRoleSpy.calls.length).to.equal(1);
+ expect(assumeRoleSpy.calls[0].arguments[0].DurationSeconds).to.equal(7200);
+ return done();
+ });
+ });
 
  describe('mfa serial callback', function() {