Botocore: Add support for setting STS Assumed Role session duration

[gene1wood]

Currently the botocore.credentials AssumeRoleProvider doesn't pass a DurationSeconds value to the client.assume_role method and so the default value (3600 seconds) is always used. I'd like to add a configuration setting to enable the user to set this session duration. I'm happy to make the PR for this but I wanted to validate that this is something that would be appropriate to add to botocore.

I would imagine that this configuration setting would be global (not profile specific), though I could imagine a user wanting to have per profile session durations. Do you think this setting should be global or profile specific?

Is role_session_duration a good name for this setting?

The PR for this would be pretty straight forward and would likely involve

• Adding a config value to the _get_role_config_values method for role_session_duration which would draw from a global config setting with a self._loaded_config.get('role_session_duration')
• Adding parsing of the role_session_duration value in the config in _assume_role_base_kwargs to pass it out as DurationSeconds
• Updating the docs to show the new config setting
• Add a test for the new setting

[JordonPhillips]

That does seem like a useful thing to have! Marking as a feature request.

[andrewkrug]

+1 I agree this would be great to have.

[gene1wood]

In starting on the code for this PR I realized that the current implementation of credentials.py in botocore uses sts:AssumeRole but not sts:GetSessionToken with sts:AssumeRole. I think this means that the 900 to 3600 second session duration constraint associated with sts:AssumeRole also applies to the MFA code that is passed to the call. Part of my goals with this PR was to be able to extend the MFA serial duration when I'm using assumed role profiles.

I believe to achieve this I'd need to change how the role assumption code in credentials.py works to something like this sequence

• Read config for some kind of session duration setting and if present
• Call sts:GetSessionToken passing in the mfa serial and code
• Get back temporary credentials (Valid from 15 mins to 36 hours)
• Do something with those credentials like store them in the ~/.aws/cli/cache
• Call sts:AssumeRole with the temporary credentials to get back a second set of temporary credentials, these one's providing access to the assumed role (Valid from 15 mins to 1 hour)
• Change the RefreshableCredentials to refresh using the GetSessionToken temporary credentials which obviate the need to re-enter an MFA code every hour.

This sounds like a beefy change and I would worry that the PR would not be accepted.

So my plan at the moment is

• Abort my efforts to implement a PR to allow for customizing the role_session_duration for the AssumeRole call as this would only allow one to reduce the duration of the session, which I don't have a personal need for at the moment
• Toss the minor amount of code and docs I've written so far for this feature
• Wait for guidance from core developers like @JordonPhillips or @jamesls as to whether introducing use of GetSessionToken into botocore is desirable. I really should open a distinct issue for that topic which I may do.
• Be happy if someone else that has the need for reducing AssumeRole session duration validity wants to write a PR for this issue
• Be happy if this issue is closed out and won't be developed

[MarkRose]

+1 on this feature. We frequently assume roles and typing 2FA codes every hour is tiring. Once every 12 hours would be convenient.

[spg]

@MarkRose @gene1wood I have a pull request open that allows using GetSessionToken: https://github.com/boto/botocore/pull/1368

[MarkRose]

Now to get that integrated into the aws cli.

[debu99]

any update on this pull request?
P.s.:
for people just want to use this feature without patch, you can change the botocore/credentials.py

699 assume_role_kwargs = deepcopy(assume_role_kwargs)
700 assume_role_kwargs['TokenCode'] = token_code
701 assume_role_kwargs['DurationSeconds'] = 21600

Add the line 701 with the time you set on the IAM role

[huiz-psma]

Hi, interested to know a timeline for this pull request. Entering MFA every hour is just not practical.

Thanks.

[gene1wood]

@debu99 @huiz-psma This is just an issue where I was hoping for @jamesls or @JordonPhillips to weigh in on my questions before starting a PR. I'd recommend checking over at the PR #1368 which is supposed to address this issue.

[swetashre]

@gene1wood - Following up on old issue. Now you can specify DurationSeconds with boto3 sts assume_role call. https://botocore.amazonaws.com/v1/documentation/api/latest/reference/services/sts.html?highlight=DurationSeconds#STS.Client.assume_role

https://boto3.amazonaws.com/v1/documentation/api/latest/guide/configuration.html#configuration

Please let me know if i am missing anything or misunderstood your request.