Missing escape for role-session-name for OIDC & temporary credentials expiration

[circleci-public]

Missing escape for role-session-name for OIDC & temporary credentials expiration

[brivu]

Hey @ad-m-ss,

Thanks for your contribution. role-session-name is actually required and can not be an empty string. I'll go ahead and add some validation for it.

In terms the article you sent, it suggests using the config file to create new profiles instead of credentials. While this is great, the assume-role-with-web-identity eliminates static credentials entirely and uses the CIRCLE_OIDC_TOKEN to create a profile with temporary keys. There is no default profile out of the box so you can't assume a role from a source-profile.

The good news is we have a command called role-arn-setup that does just that. You're able to pass in a role-arn and and source-profile that lets you create a new profile in the config file. This assumes that you run the setup command first to configure a default profile with your static credentials.

I hope that makes sense. Let me know what you think!

Best,
Brian

[ad-m-ss]

Thanks for your contribution. role-session-name is actually required and can not be an empty string. I'll go ahead and add some validation for it.

By default it have value ${CIRCLE_JOB}, so it does have value in my cases. The issue is that my value have probably spaces, so it fails on validation. Notice at the end of output:

Unknown options: on, dev-adam, chart

I believe this is due to the presence of spaces somewhere in the middle of the default parameters.

uses the CIRCLE_OIDC_TOKEN to create a profile with temporary keys.

I think this is risky, because it might fails when temporary keys expires or become invalided for some other reason. Article describes that application which consume temporary keys should be able to rotate it:

code that uses temporary credentials should be able to refresh those credentials.

Code which exports temporary keys does not follow this rule. I am aware that documentation of AWS STS does not explain that well ( awsdocs/iam-user-guide#249 ).

You might use AWS.TokenFileWebIdentityCredentials to enable application to use temporary keys and enable to refresh those credentials by application. This is the mechanism used in AWS EKS for IRSA, so it is a stable and well-established solution ( https://aws.amazon.com/blogs/opensource/introducing-fine-grained-iam-roles-service-accounts/ ) supported in all modern AWS SDK. It requires something like:

TOKEN_FILE=$(mktemp)
echo "CIRCLE_OIDC_TOKEN" > "$TOKEN_FILE"
{
    echo "export AWS_WEB_IDENTITY_TOKEN_FILE=\"${TOKEN_FILE}\""
    echo "export AWS_ROLE_ARN=\"${PARAM_AWS_CLI_ROLE_ARN}\""
} >>"$BASH_ENV"

Alternatively you might use AWS.ProcessCredentials to create profile which is able to retrieve fresh temporary keys.

[pavelkucera]

Hi,

I'm running into the same issue, my Job Name contains spaces and then it is not passed to AWS CLI properly. I believe that a fix would be to pass env variables using double quotes to prevent globbing and word splitting. Should I send a PR with that?

[brivu]

Hey @pavelkucera,

Can you show me an example config of what you mean so I can check it out? Did you mean I needed to double quote "${CIRCLE_JOB}" for the parameter's default value?

Best,
Brian

[pavelkucera]

Hi @brivu, the gist of the config:

jobs:
  aws-job:
    steps:
      - aws-cli/setup:
          role-arn: ...

workflows:
  deploy:
    jobs:
      - aws-job:
          name: Name with spaces

As for the double quoting, I think it needs to happen in shell, specifically in assume-role-with-web-identity.sh:12 I would add double quotes around ${PARAM_ROLE_SESSION_NAME} Would that make sense?

[brivu]

Yes, thank you!

[jtheuer]

I ran into the same issue and want to point out another important issue connected to this: The script didn't fail for me so my deployment continued to run and I received confusing aws authentication errors further down the build pipeline.

Can you please add validation that the env vars where correctly set and fail your script (orb) if not? I believe working with correct exit codes is a common best practice for shell (and CI) jobs.

[brivu]

Hey @jtheuer,

Can you share the snippet of your config that's failing along with the output you're getting? I want to test this on my end to isolate the issue.

You can also submit a PR with a fix and I'd be glad to take a look and merge it.

Thanks for letting us know!

Brian

[jtheuer]

Hi Brian, thanks for reaching out and taking care for this. I currently have no capacity to provide a full PR to vendors. However, setting a job name with a space should be sufficient to reproduce both issues.
Let me know when you have a fix deployed, I'm eager to try the new version.