Cross-Account roles do not work about okta-aws-cli-assume-role HOT 4 CLOSED

Cross-account roles have been working on master since the merge December 5th, 2017.

If you only have one role assigned, this tool will pick that role with no prompts.

Troubleshooting steps:

• Have you assigned multiple roles to yourself in the Okta admin portal?
  • If you can, do that.
  • If you have. Let me know. That sound like a bug.
  • If you can't, you need to revisit the setup instructions from your Amazon Web Services app's Sign On tab.

To get cross-account roles working in the Okta web portal, I had to start from scratch and follow the Connect Okta to Multiple AWS Instances section here to get it working myself:
http://saml-doc.okta.com/SAML_Docs/How-to-Configure-SAML-2.0-for-Amazon-Web-Service.html#scenarioB

The sharp edges to watch out for:

1. Case-sentitivity:
   • Every AWS account must have an IAM Role with the case-senstive exact name Okta-Idp-cross-account-role
   • The identity provider in every AWS account must have the case-senstive exact same name
2. Required Symmetry:
   • Every IAM Role you want to assume must be allowed to be assumed by the commonly named identity provider within its own account (ARN differs by account number)
3. AWS CLI session-role behaviour:
   • Every IAM Role you want to assume must also be allowed to assume itself (AWS CLI won't be able to use the roles otherwise)
   • This isn't in the app setup instructions, but it is noted in the README on this project

from okta-aws-cli-assume-role.

@mraible this issue can be closed.

from okta-aws-cli-assume-role.

Hi @AlainODea,

Sorry for the delay. We have a role that has only one permission - assume roles in different accounts. In previous version of this tool, after the main role is assumed, the policies would be queries to check if it's linked to different accounts and then it would present with a choice of roles to assume from the list of available ones. This workflow no longer works.

from okta-aws-cli-assume-role.

@liquid-sky what you describe is not a supported way of using the Amazon Web Services Okta app. The old way was complex and could not be scaled or generalized. That’s why Okta changed it. It’s also why I rewrote this tool to follow the new way. This issue is closed and will not be fixed.

Follow this guide for a supported integration with multiple AWS accounts: Connect Okta to Multiple AWS Instances:
http://saml-doc.okta.com/SAML_Docs/How-to-Configure-SAML-2.0-for-Amazon-Web-Service.html#scenarioB

from okta-aws-cli-assume-role.