Aws-vault: RFC: introduce `parent_profile` config parameter

[mtibben]

445 removed the profile chaining behaviour for mfa_device, as it broke compatibility with older versions of aws-vault, existing configs, aws-cli and the AWS SDK.

I propose that we introduce a new config parameter to the config, parent_profile, to reintroduce and extend this chaining behaviour.

Using parent_profile would allow a profile to import all of the config and credentials from the specified parent profile. This would include mfa_serial but would also extend to other config options like region and duration_seconds.

This would be a useful addition to aws-vault, as it would give users the ability to build up more complex configurations without the need for templating.

And this means that source_profile would retain it's intended semantics of importing credentials only, which means if desired you could retain compatibility with aws-cli config and the SDK. Plus aws-cli config docs would still be applicable to aws-vault

Here's example config to get you thinking about how it might work

[profile org2]
region=us-east-1
mfa_serial = arn:aws:iam::3333333333:mfa/jonsmith

[profile org2-roleA]
parent_profile=org2
role_arn = arn:aws:iam::44444444444:role/roleA

[profile org2-roleB-short]
parent_profile=org2
role_arn = arn:aws:iam::44444444444:role/roleB
duration_seconds=900

[profile org2-roleB-long]
parent_profile=org2-roleB
duration_seconds=28800

[profile org1]
region=us-east-1

[profile org1-mfa]
parent_profile=org1
mfa_serial = arn:aws:iam::111111111111:mfa/jonsmith

[profile org1-roleA]
parent_profile=org1
role_arn = arn:aws:iam::22222222222:role/ReadOnly

[profile org1-roleB]
parent_profile=org1-mfa
role_arn = arn:aws:iam::22222222222:role/Administrator

[profile org1-roleC]
parent_profile=org1-mfa
role_arn = arn:aws:iam::22222222222:role/Another-Role-Needing-MFA

Thoughts @lox @jstewmon @FernandoMiguel @rossmckelvie ?

[FernandoMiguel]

I don't see any major issues with this proposed implementation.
Although will require clear message in the changelog

Are we able to suggest the user a migration path once the new version is installed?

[frezbo]

@mtibben I suggest we namespace the new variable with vault_ so that it never conflicts with aws config variables in the future too.

[mtibben]

I feel vault_ is too generic and may be confusing. (i.e. are we specifying the parent profile for the vault? No.) If anything, aws_vault_ however that looks pretty weird, and might be just as confusing. I'll leave it as parent_profile for now unless we have a better suggestion

[rossmckelvie]

I have been using this since beta2 and have not encountered any issues in my workflow after converting my config file from using source_profile to parent_profile.