From 3280cf5e30c2a3f4a7553834bccb5dab9c6b68bb Mon Sep 17 00:00:00 2001 From: Daniel Hougaard Date: Wed, 22 Oct 2025 22:59:24 +0400 Subject: [PATCH 1/3] fix: aws auth STS assume role --- .../src/services/identity-aws-auth/identity-aws-auth-fns.ts | 6 +++--- .../identity-aws-auth/identity-aws-auth-validators.ts | 4 ++-- 2 files changed, 5 insertions(+), 5 deletions(-) diff --git a/backend/src/services/identity-aws-auth/identity-aws-auth-fns.ts b/backend/src/services/identity-aws-auth/identity-aws-auth-fns.ts index d0fb4d323..3732cf5c0 100644 --- a/backend/src/services/identity-aws-auth/identity-aws-auth-fns.ts +++ b/backend/src/services/identity-aws-auth/identity-aws-auth-fns.ts @@ -2,7 +2,7 @@ interface PrincipalArnEntity { Partition: string; Service: "iam" | "sts"; AccountNumber: string; - Type: "user" | "role" | "instance-profile"; + Type: "user" | "role" | "instance-profile" | "assumed-role"; Path: string; FriendlyName: string; SessionInfo: string; // Only populated for assumed-role @@ -49,7 +49,7 @@ export const extractPrincipalArnEntity = (arn: string): PrincipalArnEntity => { } // assumed roles use a special format where the friendly name is the role name const [roleName, sessionId] = rest; - finalType = "role"; // treat assumed role case as role + finalType = "assumed-role"; friendlyName = roleName; sessionInfo = sessionId; break; @@ -87,5 +87,5 @@ export const extractPrincipalArnEntity = (arn: string): PrincipalArnEntity => { export const extractPrincipalArn = (arn: string) => { const entity = extractPrincipalArnEntity(arn); - return `arn:aws:iam::${entity.AccountNumber}:${entity.Type}/${entity.FriendlyName}`; + return `arn:aws:${entity.Service}::${entity.AccountNumber}:${entity.Type}/${entity.FriendlyName}${entity.SessionInfo ? `/${entity.SessionInfo}` : ""}`; }; diff --git a/backend/src/services/identity-aws-auth/identity-aws-auth-validators.ts b/backend/src/services/identity-aws-auth/identity-aws-auth-validators.ts index 527d508f5..183f3cab5 100644 --- a/backend/src/services/identity-aws-auth/identity-aws-auth-validators.ts +++ b/backend/src/services/identity-aws-auth/identity-aws-auth-validators.ts @@ -6,7 +6,7 @@ const twelveDigitRegex = new RE2(/^\d{12}$/); // akhilmhdh: change this to a normal function later. Checked no redosable at the moment const arnRegex = new RE2( - /^arn:aws:iam::\d{12}:(user\/[a-zA-Z0-9_.@+*/-]+|role\/[a-zA-Z0-9_.@+*/-]+|assume-role\/[a-zA-Z0-9_.@+*/-]+|\*)$/ + /^arn:aws:(iam|sts)::\d{12}:(user\/[a-zA-Z0-9_.@+*/-]+|role\/[a-zA-Z0-9_.@+*/-]+|assumed-role\/[a-zA-Z0-9_.@+*/-]+\/[a-zA-Z0-9_.@+*/-]+|\*)$/ ); export const validateAccountIds = z @@ -55,7 +55,7 @@ export const validatePrincipalArns = z }, { message: - "Each ARN must be in the format of 'arn:aws:iam::123456789012:user/UserName', 'arn:aws:iam::123456789012:role/RoleName', 'arn:aws:iam::123456789012:assume-role/RoleName', or 'arn:aws:iam::123456789012:*'." + "Each ARN must be in the format of 'arn:aws:iam::123456789012:user/UserName', 'arn:aws:iam::123456789012:role/RoleName', or 'arn:aws:iam::123456789012:*,', 'arn:aws:sts::123456789012:assumed-role/RoleName/sessionId'." } ) // Transform to normalize the spaces around commas From f34964adf7d33d0360b48a9fd33f96d9035fb17b Mon Sep 17 00:00:00 2001 From: Daniel Hougaard Date: Wed, 22 Oct 2025 23:15:25 +0400 Subject: [PATCH 2/3] remove session id extraction --- .../src/services/identity-aws-auth/identity-aws-auth-fns.ts | 2 +- .../identity-aws-auth/identity-aws-auth-validators.ts | 4 ++-- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/backend/src/services/identity-aws-auth/identity-aws-auth-fns.ts b/backend/src/services/identity-aws-auth/identity-aws-auth-fns.ts index 3732cf5c0..c8b494e7b 100644 --- a/backend/src/services/identity-aws-auth/identity-aws-auth-fns.ts +++ b/backend/src/services/identity-aws-auth/identity-aws-auth-fns.ts @@ -87,5 +87,5 @@ export const extractPrincipalArnEntity = (arn: string): PrincipalArnEntity => { export const extractPrincipalArn = (arn: string) => { const entity = extractPrincipalArnEntity(arn); - return `arn:aws:${entity.Service}::${entity.AccountNumber}:${entity.Type}/${entity.FriendlyName}${entity.SessionInfo ? `/${entity.SessionInfo}` : ""}`; + return `arn:aws:${entity.Service}::${entity.AccountNumber}:${entity.Type}/${entity.FriendlyName}`; }; diff --git a/backend/src/services/identity-aws-auth/identity-aws-auth-validators.ts b/backend/src/services/identity-aws-auth/identity-aws-auth-validators.ts index 183f3cab5..fa2432408 100644 --- a/backend/src/services/identity-aws-auth/identity-aws-auth-validators.ts +++ b/backend/src/services/identity-aws-auth/identity-aws-auth-validators.ts @@ -6,7 +6,7 @@ const twelveDigitRegex = new RE2(/^\d{12}$/); // akhilmhdh: change this to a normal function later. Checked no redosable at the moment const arnRegex = new RE2( - /^arn:aws:(iam|sts)::\d{12}:(user\/[a-zA-Z0-9_.@+*/-]+|role\/[a-zA-Z0-9_.@+*/-]+|assumed-role\/[a-zA-Z0-9_.@+*/-]+\/[a-zA-Z0-9_.@+*/-]+|\*)$/ + /^arn:aws:(iam|sts)::\d{12}:(user\/[a-zA-Z0-9_.@+*/-]+|role\/[a-zA-Z0-9_.@+*/-]+|assumed-role\/[a-zA-Z0-9_.@+*/-]+|\*)$/ ); export const validateAccountIds = z @@ -55,7 +55,7 @@ export const validatePrincipalArns = z }, { message: - "Each ARN must be in the format of 'arn:aws:iam::123456789012:user/UserName', 'arn:aws:iam::123456789012:role/RoleName', or 'arn:aws:iam::123456789012:*,', 'arn:aws:sts::123456789012:assumed-role/RoleName/sessionId'." + "Each ARN must be in the format of 'arn:aws:iam::123456789012:user/UserName', 'arn:aws:iam::123456789012:role/RoleName', or 'arn:aws:iam::123456789012:*,', 'arn:aws:sts::123456789012:assumed-role/RoleName'." } ) // Transform to normalize the spaces around commas From d04854e07600794efa8c9beafade44a7b76e4f1f Mon Sep 17 00:00:00 2001 From: Daniel Hougaard Date: Wed, 22 Oct 2025 23:23:02 +0400 Subject: [PATCH 3/3] Update identity-aws-auth-validators.ts --- .../services/identity-aws-auth/identity-aws-auth-validators.ts | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/backend/src/services/identity-aws-auth/identity-aws-auth-validators.ts b/backend/src/services/identity-aws-auth/identity-aws-auth-validators.ts index fa2432408..4e3884e15 100644 --- a/backend/src/services/identity-aws-auth/identity-aws-auth-validators.ts +++ b/backend/src/services/identity-aws-auth/identity-aws-auth-validators.ts @@ -55,7 +55,7 @@ export const validatePrincipalArns = z }, { message: - "Each ARN must be in the format of 'arn:aws:iam::123456789012:user/UserName', 'arn:aws:iam::123456789012:role/RoleName', or 'arn:aws:iam::123456789012:*,', 'arn:aws:sts::123456789012:assumed-role/RoleName'." + "Each ARN must be in the format of 'arn:aws:iam::123456789012:user/UserName', 'arn:aws:iam::123456789012:role/RoleName', or 'arn:aws:iam::123456789012:*', 'arn:aws:sts::123456789012:assumed-role/RoleName'." } ) // Transform to normalize the spaces around commas