The s3-credentials.AmazonS3FullAccess role created by

<div class="snippet-clipboard-content notranslate position-relative overflow-auto" data-snippet-clip

s3-credentials.AmazonS3FullAccess has MaxSessionDuration 3600, should be 12 hours about s3-credentials HOT 5 CLOSED

simonw commented on July 19, 2024

s3-credentials.AmazonS3FullAccess has MaxSessionDuration 3600, should be 12 hours

from s3-credentials.

Comments (5)

simonw commented on July 19, 2024

https://boto3.amazonaws.com/v1/documentation/api/latest/reference/services/iam.html#IAM.Client.create_role confirms that the default value is 1 hour.

from s3-credentials.

simonw commented on July 19, 2024

https://boto3.amazonaws.com/v1/documentation/api/latest/reference/services/iam.html#IAM.Client.update_role can be used to update the role to fix this.

from s3-credentials.

simonw commented on July 19, 2024

~ % s3-credentials list-roles s3-credentials.AmazonS3FullAccess
[
  {
    "Path": "/",
    "RoleName": "s3-credentials.AmazonS3FullAccess",
    "RoleId": "AROAWXFXAIOZKX4I47KJM",
    "Arn": "arn:aws:iam::462092780466:role/s3-credentials.AmazonS3FullAccess",
    "CreateDate": "2021-11-10 01:53:24+00:00",
    "AssumeRolePolicyDocument": {
      "Version": "2012-10-17",
      "Statement": [
        {
          "Effect": "Allow",
          "Principal": {
            "AWS": "arn:aws:iam::462092780466:root"
          },
          "Action": "sts:AssumeRole",
          "Condition": {}
        }
      ]
    },
    "Description": "Role used by the s3-credentials tool to create time-limited credentials that are restricted to specific buckets",
    "MaxSessionDuration": 3600
  }
]

from s3-credentials.

simonw commented on July 19, 2024

Manually tested the fix by deleting my s3-credentials.AmazonS3FullAccess role and then running this command:

 % s3-credentials create datasette-cloud-backups -d 1h                    
Assume role against arn:aws:iam::462092780466:role/s3-credentials.AmazonS3FullAccess for 3600s
{
    "AccessKeyId": "ASIAWXFXAIOZG4XZQ54R",
    "SecretAccessKey": "...",
    "SessionToken": "F...",
    "Expiration": "2022-08-01 20:38:24+00:00"
}