Feature Request - AWS Secret Backend: Add RoleSessionName support to STS

[yakireliyahu87]

Hey,
Looking at the documentation of "Generating IAM with STS", which is intended to assume roles (whether local/cross-account), I noticed that there's no way to assign this assumed role a custom "Session Name".

This is possible when using the AWS API directly using the RoleSessionName Identifier.

Will it be possible to add a parameter "session_name" to the payload of the API request to Vault, so the assume-role operation will include it?

This would be very helpful when the same role is assumed multiple times by different users in our system, and will allow to inspect user actions via CloudTrail.

In my case, my system will need to assume a role in another AWS account multiple time (one time per user in my system), and i would like to know which user performed a certain operation on the target AWS account (using CloudTrail).

Thanks,
Yakir.

[mdgreenfield]

While this issue is to support a session-name parameter when retrieving STS credentials should be ok from an authenticated Vault request I'd actually like to see something implemented more along the lines of the SSH plugin where an identity template can be passed into the role configuration (see #7548).

The problem I have with the current RoleSessionName format is that it is pseudo-random.

vault/builtin/logical/aws/secret_access_keys.go

Line 64 in d9ee625

ret = fmt.Sprintf("vault-%s%d-%d", midString, time.Now().Unix(), rand.Int31n(10000))

And because searching CloudTrail logs by username does not allow for globs or partial matching it means that the CloudTrail logs must be downloaded and post-processed.

One suggestion to help improve tracing between Vault audit logs and CloudTrail logs would be to include the role_session_name in the /aws/sts/:name response. Vault admins would be required to configure audit_non_hmac_response_keys but short of making the RoleSessionName deterministic I think this could be a fine approach.

[mechastorm]

I think the original request for this feature could be resolved by this PR ? #11345

[vishalnayak]

Fixed by #11345