awatertrevi/infisical
1
0
Fork 0
mirror of https://github.com/awatertrevi/infisical.git synced 2026-09-22 13:39:35 +00:00
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #4735 from Infisical/daniel/aws-arn-validation-fix

Browse Source 
fix: backwards compatibility for assumed roles as role formatting
This commit is contained in:
Daniel Hougaard
2025-10-23 22:23:08 +04:00
committed by GitHub
parent 1bf55017a1 e9c97c9ed3
commit 19f50b3564
2 changed files with 6 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files

10
backend/src/services/identity-aws-auth/identity-aws-auth-fns.ts
View File

@@ -8,7 +8,7 @@ interface PrincipalArnEntity {
SessionInfo: string; // Only populated for assumed-role
}
export const extractPrincipalArnEntity = (arn: string): PrincipalArnEntity => {
export const extractPrincipalArnEntity = (arn: string, formatAsIamRole: boolean = false): PrincipalArnEntity => {
// split the ARN into parts using ":" as the delimiter
const fullParts = arn.split(":");
if (fullParts.length !== 6) {
@@ -49,7 +49,7 @@ export const extractPrincipalArnEntity = (arn: string): PrincipalArnEntity => {
}
// assumed roles use a special format where the friendly name is the role name
const [roleName, sessionId] = rest;
finalType = "assumed-role";
finalType = formatAsIamRole ? "role" : "assumed-role";
friendlyName = roleName;
sessionInfo = sessionId;
break;
@@ -84,8 +84,8 @@ export const extractPrincipalArnEntity = (arn: string): PrincipalArnEntity => {
* - arn:aws:iam::123456789012:user/MyUserName
* - arn:aws:iam::123456789012:role/MyRoleName
*/
export const extractPrincipalArn = (arn: string) => {
const entity = extractPrincipalArnEntity(arn);
export const extractPrincipalArn = (arn: string, formatAsIamRole: boolean = false) => {
const entity = extractPrincipalArnEntity(arn, formatAsIamRole);
return `arn:aws:${entity.Service}::${entity.AccountNumber}:${entity.Type}/${entity.FriendlyName}`;
return `arn:aws:${formatAsIamRole ? "iam" : entity.Service}::${entity.AccountNumber}:${entity.Type}/${entity.FriendlyName}`;
};

2
backend/src/services/identity-aws-auth/identity-aws-auth-service.ts
View File

@@ -158,7 +158,7 @@ export const identityAwsAuthServiceFactory = ({
// considers exact matches + wildcard matches
// heavily validated in router
const regex = new RE2(`^${principalArn.replaceAll("*", ".*")}$`);
return regex.test(formattedArn);
return regex.test(formattedArn) || regex.test(extractPrincipalArn(Arn, true));
});
if (!isArnAllowed) {