Improved error handling forAssume Role with Web Identity command about aws-cli-orb HOT 4 CLOSED

Hey @adamdmharvey,

I did some digging and I ended validating the command by using ${PIPESTATUS[0]}. It'll cause the command to fail with the appropriate errors and exit codes from AWS

Best,
Brian

from aws-cli-orb.

Hey @adamdmharvey,

Thanks for letting us know. I think this is a bug with the AWS CLI specifically.

In the script below, I am purposely setting PARAM_ROLE_SESSION_NAME to a blank space so that the command fails. I am also echoing $? to check the status code of the command.

As you can see below, the script obviously fails judging from the error message, yet the exit code is still 0.

The only thing I can think of is adding our own validation checking to see if the PARAM_ROLE_SESSION_NAME is empty along with the AWS_SESSION_TOKEN. The thought is if assuming the role is successful, a session token is generated. If there is no session token, then the command failed.

My question is in your specific case, is a session token generated? If there is, can you think of any other way to handle the error?

Let me know and thanks for catching this!

Best,
Brian

from aws-cli-orb.

Thanks, @brivu . My speculation was it was not an error with the CLI, and unrelated to the session name, but with the wrapping of the CLI call into the read statement, such that any error in the CLI would effectively be "trapped" by the outer command, and even if the result was invalid environment variables, we'd get an exit 0.

Just running a raw assume role which fails, it definitely returns an exit code 254:

$ aws sts assume-role-with-web-identity \
            --role-arn 'arn:aws:iam::1234567890:role/fake-role' \
            --role-session-name 'my-session' \
            --web-identity-token 'fake-token' \
            --duration-seconds 3600 \
            --query 'Credentials.[AccessKeyId,SecretAccessKey,SessionToken]' \
            --output text

An error occurred (InvalidIdentityToken) when calling the AssumeRoleWithWebIdentity operation: The ID Token provided is not a valid JWT. (You may see this error if you sent an Access Token)

$ echo $?
254

Excited about your change; thanks for the quick turnaround. Happy to give it a shot on my end!!

from aws-cli-orb.

My team and I just tested this orb fix and can confirm a user who is not authorized to assume the role in AWS, when triggering the pipeline now successfully gets an error message on this step. So for now, the fix addresses my issue; thanks Brian!

from aws-cli-orb.