awatertrevi/infisical
1
0
Fork 0
mirror of https://github.com/awatertrevi/infisical.git synced 2026-10-10 10:29:17 +00:00
Code Issues Packages Projects Releases Wiki Activity

fix: improve error handling in AWS IAM role assumption methods

Browse Source 
- Added try-catch blocks to handle errors during role assumption in both assumePamRole and assumeTargetRole functions.
- Enhanced error messages to include specific details about the failure, improving debugging and user feedback.
- Updated console URL generation to directly use the SigninToken from the token response, ensuring correct URL formation.
This commit is contained in:
Victor Santos
2025-12-07 20:48:15 -03:00
parent 3e77c33532
commit a0718321e7
1 changed files with 44 additions and 34 deletions
Download Patch File Download Diff File Expand all files Collapse all files
backend/src/ee/services/pam-resource/aws-iam/aws-iam-federation.ts
+19 -9
View File
@@ -63,6 +63,7 @@ const assumePamRole = async ({
}): Promise<Credentials | null> => {
const stsClient = createStsClient();
try {
const result = await stsClient.send(
new AssumeRoleCommand({
RoleArn: connectionDetails.roleArn,
@@ -82,6 +83,14 @@ const assumePamRole = async ({
}
return result.Credentials;
} catch (error) {
if (throwOnError) {
throw new InternalServerError({
message: `Failed to assume PAM role - AWS STS did not return credentials: ${error instanceof Error ? error.message : "Unknown error"}`
});
}
return null;
}
};
/**
@@ -105,6 +114,7 @@ const assumeTargetRole = async ({
}): Promise<Credentials | null> => {
const chainedStsClient = createStsClient(pamCredentials);
try {
const result = await chainedStsClient.send(
new AssumeRoleCommand({
RoleArn: targetRoleArn,
@@ -124,6 +134,14 @@ const assumeTargetRole = async ({
}
return result.Credentials;
} catch (error) {
if (throwOnError) {
throw new InternalServerError({
message: `Failed to assume target role - AWS STS did not return credentials: ${error instanceof Error ? error.message : "Unknown error"}`
});
}
return null;
}
};
export const validatePamRoleConnection = async (
@@ -217,16 +235,8 @@ export const generateConsoleFederationUrl = async ({
});
}
const tokenData = tokenResponse.data;
if (!tokenData.SigninToken) {
throw new InternalServerError({
message: `AWS federation endpoint did not return a SigninToken: ${JSON.stringify(tokenResponse.data).substring(0, 200)}`
});
}
const consoleDestination = `https://console.aws.amazon.com/`;
const consoleUrl = `${federationEndpoint}?Action=login&SigninToken=${encodeURIComponent(tokenData.SigninToken)}&Destination=${encodeURIComponent(consoleDestination)}`;
const consoleUrl = `${federationEndpoint}?Action=login&SigninToken=${encodeURIComponent(tokenResponse.data.SigninToken)}&Destination=${encodeURIComponent(consoleDestination)}`;
return {
consoleUrl,