Skip to content

fix: credential method selection for chained vs non-chained MFA #87

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
wants to merge 6 commits into
base: main
Choose a base branch
from
Open

fix: credential method selection for chained vs non-chained MFA #87

Changes from all commits
Commits
Show all changes
6 commits
Select commit Hold shift + click to select a range
df543cd
fix: handle unchained credential sources
propilideno Aug 16, 2025
773d7b6
fix: return if cannot use GetSessionToken in chained methods to avoid…
propilideno Aug 17, 2025
efc36b8
style: reverting to the original way to verify if is chainedMfa
propilideno Aug 17, 2025
8bd1b67
merge: from ByteNess/aws-vault, resolving conflits
propilideno Aug 17, 2025
b0615a8
merge: resolving conflicts
propilideno Aug 17, 2025
1912e26
fix: source chaining treated like role chaining
propilideno Sep 28, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
30 changes: 9 additions & 21 deletions vault/vault.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -254,22 +254,9 @@ func (t *TempCredentialsCreator) getSourceCredWithSession(config *ProfileConfig,
return nil, err
}

if hasStoredCredentials || !config.HasRole() {
if canUseGetSessionToken, reason := t.canUseGetSessionToken(config); !canUseGetSessionToken {
log.Printf("profile %s: skipping GetSessionToken because %s", config.ProfileName, reason)
if !config.HasRole() {
return sourcecredsProvider, nil
}
}
t.chainedMfa = config.MfaSerial
log.Printf("profile %s: using GetSessionToken %s", config.ProfileName, mfaDetails(false, config))
sourcecredsProvider, err = NewSessionTokenProvider(sourcecredsProvider, t.Keyring.Keyring, config, !t.DisableCache)
if !config.HasRole() || err != nil {
return sourcecredsProvider, err
}
}
isRoleChaining := config.ChainedFromProfile != nil && config.ChainedFromProfile.RoleARN != ""

if config.HasRole() {
if config.HasRole() && !isRoleChaining {
isMfaChained := config.MfaSerial != "" && config.MfaSerial == t.chainedMfa
if isMfaChained {
config.MfaSerial = ""
Expand All @@ -278,14 +265,15 @@ func (t *TempCredentialsCreator) getSourceCredWithSession(config *ProfileConfig,
return NewAssumeRoleProvider(sourcecredsProvider, t.Keyring.Keyring, config, !t.DisableCache)
}

if isMasterCredentialsProvider(sourcecredsProvider) {
if isMasterCredentialsProvider(sourcecredsProvider) || isRoleChaining {
canUseGetSessionToken, reason := t.canUseGetSessionToken(config)
if canUseGetSessionToken {
t.chainedMfa = config.MfaSerial
log.Printf("profile %s: using GetSessionToken %s", config.ProfileName, mfaDetails(false, config))
return NewSessionTokenProvider(sourcecredsProvider, t.Keyring.Keyring, config, !t.DisableCache)
if !canUseGetSessionToken {
log.Printf("profile %s: skipping GetSessionToken because %s", config.ProfileName, reason)
return sourcecredsProvider, nil
}
log.Printf("profile %s: skipping GetSessionToken because %s", config.ProfileName, reason)
t.chainedMfa = config.MfaSerial
log.Printf("profile %s: using GetSessionToken %s", config.ProfileName, mfaDetails(false, config))
return NewSessionTokenProvider(sourcecredsProvider, t.Keyring.Keyring, config, !t.DisableCache)
}

return sourcecredsProvider, nil
Expand Down
Loading