diff --git a/backend/src/ee/services/pam-session/pam-session-dal.ts b/backend/src/ee/services/pam-session/pam-session-dal.ts index ad14f4976..094614859 100644 --- a/backend/src/ee/services/pam-session/pam-session-dal.ts +++ b/backend/src/ee/services/pam-session/pam-session-dal.ts @@ -31,7 +31,7 @@ export const pamSessionDALFactory = (db: TDbClient) => { .where("id", sessionId) .whereIn("status", [PamSessionStatus.Active, PamSessionStatus.Starting]) .update({ - status: PamSessionStatus.Expired, + status: PamSessionStatus.Ended, endedAt: now }); diff --git a/backend/src/ee/services/pam-session/pam-session-enums.ts b/backend/src/ee/services/pam-session/pam-session-enums.ts index 299f2c29a..33afe95e4 100644 --- a/backend/src/ee/services/pam-session/pam-session-enums.ts +++ b/backend/src/ee/services/pam-session/pam-session-enums.ts @@ -1,7 +1,6 @@ export enum PamSessionStatus { Starting = "starting", // Starting, user connecting to resource Active = "active", // Active, user is connected to resource - Ended = "ended", // Ended by user - Terminated = "terminated", // Terminated by an admin - Expired = "expired" // Automatically expired after expiresAt timestamp + Ended = "ended", // Ended by user or automatically expired after expiresAt timestamp + Terminated = "terminated" // Terminated by an admin } diff --git a/backend/src/ee/services/pam-session/pam-session-service.ts b/backend/src/ee/services/pam-session/pam-session-service.ts index d984517e4..bdb82e650 100644 --- a/backend/src/ee/services/pam-session/pam-session-service.ts +++ b/backend/src/ee/services/pam-session/pam-session-service.ts @@ -53,7 +53,7 @@ export const pamSessionServiceFactory = ({ if (isActive && isExpired) { // eslint-disable-next-line @typescript-eslint/no-unsafe-assignment const updatedSession = await pamSessionDAL.updateById(session.id, { - status: PamSessionStatus.Expired, + status: PamSessionStatus.Ended, endedAt: new Date() }); // eslint-disable-next-line @typescript-eslint/no-unsafe-argument @@ -200,7 +200,7 @@ export const pamSessionServiceFactory = ({ throw new ForbiddenRequestError({ message: "Only identities and users can perform this action" }); } - if (session.status === PamSessionStatus.Ended || session.status === PamSessionStatus.Expired) { + if (session.status === PamSessionStatus.Ended) { return { session, projectId: project.id diff --git a/frontend/src/hooks/api/pam/enums.ts b/frontend/src/hooks/api/pam/enums.ts index 9da4e74b8..c6dfcd70c 100644 --- a/frontend/src/hooks/api/pam/enums.ts +++ b/frontend/src/hooks/api/pam/enums.ts @@ -29,8 +29,7 @@ export enum PamSessionStatus { Starting = "starting", Active = "active", Ended = "ended", - Terminated = "terminated", - Expired = "expired" + Terminated = "terminated" } // Accounts diff --git a/frontend/src/pages/pam/PamAccountsPage/components/PamAccountForm/AwsIamAccountForm.tsx b/frontend/src/pages/pam/PamAccountsPage/components/PamAccountForm/AwsIamAccountForm.tsx index 904bee1cf..87763b851 100644 --- a/frontend/src/pages/pam/PamAccountsPage/components/PamAccountForm/AwsIamAccountForm.tsx +++ b/frontend/src/pages/pam/PamAccountsPage/components/PamAccountForm/AwsIamAccountForm.tsx @@ -148,10 +148,10 @@ export const AwsIamAccountForm = ({ account, onSubmit }: Props) => {

- The target role must have a trust policy that allows the Infisical PAM role you - created and used in the "Resources" tab to assume it. If you used the{" "} - infisical-pam-*{" "} - naming convention, no additional changes are needed to the PAM role. + The target role must have a trust policy that allows the PAM role (created in the + "Resources" tab) to assume it. If your target role name follows the + wildcard pattern you defined in the PAM role's permissions policy, no + additional changes are needed.

@@ -170,13 +170,12 @@ export const AwsIamAccountForm = ({ account, onSubmit }: Props) => { <YOUR_ACCOUNT_ID> with your AWS account ID and{" "} <YOUR_PAM_ROLE_NAME>{" "} - with the name of the PAM role you created and used in the "Resources" tab - (e.g., InfisicalPAMRole). The + with the name of the PAM role you created in the "Resources" tab. The External ID{" "} {projectId} is your - current project ID. If your target role name doesn't follow the{" "} - infisical-pam-* pattern, you - must update the PAM role's permissions policy to include the target role ARN. + current project ID. If this target role name doesn't match the wildcard pattern + in your PAM role's permissions policy, you'll need to update that policy + to include this role's ARN.

diff --git a/frontend/src/pages/pam/PamResourcesPage/components/PamResourceForm/AwsIamResourceForm.tsx b/frontend/src/pages/pam/PamResourcesPage/components/PamResourceForm/AwsIamResourceForm.tsx index 515619449..ec97d0a6f 100644 --- a/frontend/src/pages/pam/PamResourcesPage/components/PamResourceForm/AwsIamResourceForm.tsx +++ b/frontend/src/pages/pam/PamResourcesPage/components/PamResourceForm/AwsIamResourceForm.tsx @@ -57,7 +57,7 @@ export const AwsIamResourceForm = ({ resource, onSubmit }: Props) => { "Statement": [{ "Effect": "Allow", "Action": "sts:AssumeRole", - "Resource": "arn:aws:iam:::role/infisical-pam-*" + "Resource": "arn:aws:iam:::role/-*" }] }`; @@ -148,9 +148,12 @@ export const AwsIamResourceForm = ({ resource, onSubmit }: Props) => { Step 1: Create a permissions policy for assuming target roles

- This policy allows the PAM role to assume target roles. We recommend using the{" "} - infisical-pam-*{" "} - naming convention for target roles. + This policy allows the PAM role to assume target roles. We recommend using a + wildcard pattern (e.g.,{" "} + pam-* or{" "} + privileged-*) so you + can add new accounts without updating this policy. Choose a prefix that fits your + naming conventions.

diff --git a/frontend/src/pages/pam/PamSessionsPage/components/PamSessionStatusBadge.tsx b/frontend/src/pages/pam/PamSessionsPage/components/PamSessionStatusBadge.tsx index d701d3e23..1b347210e 100644 --- a/frontend/src/pages/pam/PamSessionsPage/components/PamSessionStatusBadge.tsx +++ b/frontend/src/pages/pam/PamSessionsPage/components/PamSessionStatusBadge.tsx @@ -2,7 +2,6 @@ import { ActivityIcon, BanIcon, ChevronsLeftRightEllipsisIcon, - ClockIcon, GavelIcon, LucideIcon } from "lucide-react"; @@ -34,10 +33,6 @@ const PAM_SESSION_STATUS_CONFIG: Record = { [PamSessionStatus.Ended]: { variant: "neutral", icon: BanIcon - }, - [PamSessionStatus.Expired]: { - variant: "warning", - icon: ClockIcon } };