fix: add fallback when session duration exceeds role's MaxSessionDura…#1515
Open
shyamnalluri wants to merge 1 commit intoVersent:masterfrom
Open
fix: add fallback when session duration exceeds role's MaxSessionDura…#1515shyamnalluri wants to merge 1 commit intoVersent:masterfrom
shyamnalluri wants to merge 1 commit intoVersent:masterfrom
Conversation
…tion When the configured aws_session_duration exceeds the IAM role's MaxSessionDuration, AWS STS returns a ValidationError. Previously, this would cause login to fail immediately. This commit adds error handling to detect this specific ValidationError and automatically retry the AssumeRoleWithSAML call without the DurationSeconds parameter, allowing AWS to use the role's configured maximum duration. Changes: - Import aws/awserr for error type checking - Detect ValidationError with MaxSessionDuration message - Retry without DurationSeconds on detection - Log warning and success messages for user clarity Fixes Versent#1514 Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
Fixes #1514
When the configured
aws_session_durationexceeds the IAM role'sMaxSessionDuration, AWS STS returns a ValidationError that previously caused login to fail immediately. This PR adds graceful error handling to automatically retry with the role's configured maximum duration.Changes
awserrimport for AWS error type checkingDurationSecondsparameterBehavior
Before
Error logging into AWS role using SAML assertion.: Error retrieving STS credentials using SAML.: ValidationError: The requested DurationSeconds exceeds the MaxSessionDuration set for this role.
❌ Login fails completely
After
Requesting AWS credentials using SAML assertion.
Warning: Requested session duration (43200 seconds) exceeds the role's MaxSessionDuration.
Retrying with role's default/maximum session duration...
Successfully obtained credentials with role's maximum session duration.
Logged in as: arn:aws:sts::123456789012:assumed-role/MyRole/user@example.com
✅ Login succeeds with role's maximum duration
Testing
Compatibility