awatertrevi/infisical
1
0
Fork 0
mirror of https://github.com/awatertrevi/infisical.git synced 2026-09-22 13:39:35 +00:00
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #4725 from Infisical/daniel/aws-auth-3

Browse Source 
fix: aws auth with sts assume role
This commit is contained in:
Daniel Hougaard
2025-10-22 23:25:27 +04:00
committed by GitHub
parent 874cead0f0 361a66c26a
commit 39cbdca9eb
2 changed files with 5 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files

6
backend/src/services/identity-aws-auth/identity-aws-auth-fns.ts
View File

@@ -2,7 +2,7 @@ interface PrincipalArnEntity {
Partition: string; Partition: string;
Service: "iam" | "sts"; Service: "iam" | "sts";
AccountNumber: string; AccountNumber: string;
Type: "user" | "role" | "instance-profile"; Type: "user" | "role" | "instance-profile" | "assumed-role";
Path: string; Path: string;
FriendlyName: string; FriendlyName: string;
SessionInfo: string; // Only populated for assumed-role SessionInfo: string; // Only populated for assumed-role
@@ -49,7 +49,7 @@ export const extractPrincipalArnEntity = (arn: string): PrincipalArnEntity => {
} }
// assumed roles use a special format where the friendly name is the role name // assumed roles use a special format where the friendly name is the role name
const [roleName, sessionId] = rest; const [roleName, sessionId] = rest;
finalType = "role"; // treat assumed role case as role finalType = "assumed-role";
friendlyName = roleName; friendlyName = roleName;
sessionInfo = sessionId; sessionInfo = sessionId;
break; break;
@@ -87,5 +87,5 @@ export const extractPrincipalArnEntity = (arn: string): PrincipalArnEntity => {
export const extractPrincipalArn = (arn: string) => { export const extractPrincipalArn = (arn: string) => {
const entity = extractPrincipalArnEntity(arn); const entity = extractPrincipalArnEntity(arn);
return `arn:aws:iam::${entity.AccountNumber}:${entity.Type}/${entity.FriendlyName}`; return `arn:aws:${entity.Service}::${entity.AccountNumber}:${entity.Type}/${entity.FriendlyName}`;
}; };

4
backend/src/services/identity-aws-auth/identity-aws-auth-validators.ts
View File

@@ -6,7 +6,7 @@ const twelveDigitRegex = new RE2(/^\d{12}$/);
// akhilmhdh: change this to a normal function later. Checked no redosable at the moment // akhilmhdh: change this to a normal function later. Checked no redosable at the moment
const arnRegex = new RE2( const arnRegex = new RE2(
/^arn:aws:iam::\d{12}:(user\/[a-zA-Z0-9_.@+*/-]+|role\/[a-zA-Z0-9_.@+*/-]+|assume-role\/[a-zA-Z0-9_.@+*/-]+|\*)$/ /^arn:aws:(iam|sts)::\d{12}:(user\/[a-zA-Z0-9_.@+*/-]+|role\/[a-zA-Z0-9_.@+*/-]+|assumed-role\/[a-zA-Z0-9_.@+*/-]+|\*)$/
); );
export const validateAccountIds = z export const validateAccountIds = z
@@ -55,7 +55,7 @@ export const validatePrincipalArns = z
}, },
{ {
message: message:
"Each ARN must be in the format of 'arn:aws:iam::123456789012:user/UserName', 'arn:aws:iam::123456789012:role/RoleName', 'arn:aws:iam::123456789012:assume-role/RoleName', or 'arn:aws:iam::123456789012:*'." "Each ARN must be in the format of 'arn:aws:iam::123456789012:user/UserName', 'arn:aws:iam::123456789012:role/RoleName', or 'arn:aws:iam::123456789012:*', 'arn:aws:sts::123456789012:assumed-role/RoleName'."
} }
) )
// Transform to normalize the spaces around commas // Transform to normalize the spaces around commas