Aws-iam-authenticator: Make 15-minute token limit configurable

[chris-codaio]

15 minutes is annoying short for my dev team's experience. We use Okta federated AWS authentication, so having to go through the password + 2FA dance every 15 minutes is really asking too much.

[jsco2t]

Our team has a similar setup - and have been using the generated tokens to perform auth into the k8s dashboard. This same 15 minute limitation makes it a serious pain to do any real work with the dashboard.

[joegoggins]

I followed the referenced #75 and saw that this technical capability is more complex than it seems.

The technical blocker is AWS. Their "Authenticating Requests (AWS Signature Version 4)" does not provide configurability with regard to the token's time limit. ( here is the referenced document)

This is really unfortunate. I'm all :+1: for security, but this limitation destroys team productivity and creates frustration. My team loves our Kubernetes tooling as is, this 15 minute token limit will kill that joy once we we begin enforcing it. I'm hoping there is a way to address this or perhaps a scalable work around we could consider.

Is there anyone reading this that works at AWS that could comment or recommend potential next steps to take to move in a direction that allows this token's time limit to be increased?

[fejta-bot]

Issues go stale after 90d of inactivity.
Mark the issue as fresh with /remove-lifecycle stale.
Stale issues rot after an additional 30d of inactivity and eventually close.

If this issue is safe to close now please do so with /close.

Send feedback to sig-testing, kubernetes/test-infra and/or fejta.
/lifecycle stale

[nckturner]

Increasing the pre-signed URL duration is not something we can do at this point, but let me know if #193 addressed the difficulties around MFA. It caches the temporary credentials instead of the token.

[fejta-bot]

Stale issues rot after 30d of inactivity.
Mark the issue as fresh with /remove-lifecycle rotten.
Rotten issues close after an additional 30d of inactivity.

If this issue is safe to close now please do so with /close.

Send feedback to sig-testing, kubernetes/test-infra and/or fejta.
/lifecycle rotten

[fejta-bot]

Rotten issues close after 30d of inactivity.
Reopen the issue with /reopen.
Mark the issue as fresh with /remove-lifecycle rotten.

Send feedback to sig-testing, kubernetes/test-infra and/or fejta.
/close

[k8s-ci-robot]

@fejta-bot: Closing this issue.

In response to this:

Rotten issues close after 30d of inactivity.
Reopen the issue with /reopen.
Mark the issue as fresh with /remove-lifecycle rotten.

Send feedback to sig-testing, kubernetes/test-infra and/or fejta.
/close

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

[norganna]

For anyone else affected by this 15 minute limitation that is interested in a sideways hack around this issue, I have created a proxy that performs the regular aws-iam-authentication every 10 minutes for you and injects the tokens into the requests as it forwards them on.

Hopefully one day there will be the ability to authenticate for more than 15 minutes at a time, but for now this solution improves my productivity:

kdash authenticating dashboard proxy

[booleanbetrayal]

Definitely seems like this is still relevant. Seems like AWS Signature Version 4 should allow some reasonable range of token expiration. What's the best way to approach that request?