Issue #5 #6

Is this just me? I have the latest Chrome, but the plugin doesn't work anymore (it did previously)

Failing that, my URL's appear to be now prefixed with the region, eg:

https://us-west-2.console.aws.amazon.com/cloudwatch/home?region=us-west-2

Maybe thats not matching the URLs that this is allowed to use?

I've just had a user who I gave my "role" config to. They cut-and-paste'd it into the Chrome Extnesion and then proceeded to log into the AWS Console.

After login, they had no roles. I since found out that aws_account_id needs to be set to the same text/numbers used when entering your login credentials on the AWS console login form.

Once we changed this in the extensions config, they roles appeared.

I have an IAM user called "richard.scott" in an AWS account with an ID of 123456789012.
When I log into that IAM account I am unable to show a restricted list of Roles sepcific to that user/account combination.

I have tried the following:

[MyAccount]
aws_account_id = richard.scott@123456789012

[profile Marketing]
role_arn = arn:aws:iam::123456789012:role/marketingadmin
source_profile = MyAccount

If I untick "Show only matching roles" i get to see ALL roles configured which is not what I want.

How can I do this? Is there an example as I could not find one.
The examples all seem to assume you are logging in with the root username which is bad practice.

Any interest in adding support for safari? I have chrome but safari much better at battery on mac.

It would be great if configurations could be read from a remote source file over HTTP/S. I can a see use case where we may want to generate this source file dynamically based on data about the user.

Ex. http://fqdn/aws_accounts/?user=hb3b

Ben

The color option is only changing the colour of a thin horizontal bar under the topmost aws shortcut menus. The colors of the squares in the drop down menu are all grey.

My config

[profile OSSSIO-test]
role_arn = arn:aws:iam::xxxxxxxxxx:role/ITOCAccountAccess
color = 00FF00

If I click on the details link in my pipeline console with a cloudformation provider, I want to switch to the directly to target account.

The link targeting to:
https://eu-central-1.console.aws.amazon.com/cloudformation/home?#/changeset/detail?changeSetId=arn:aws:cloudformation:eu-central-1:{AccountID}:changeSet/changeset/e28dffd1-e857-41cc-84b0-6d71xxxxxxxxx

Is this possible?

First, some background on my particular scenario. I have one AWS account ID and multiple IAM Users with different roles. To switch IAM Users, I obviously have to log out of the AWS console and log back in with a different IAM user name.

The problem I'm having is that the plugin doesn't seem to show the correct roles list for the currently logged in IAM user. It seems to only use the IAM roles from whichever IAM user is listed last in the config.

Is there currently any way for the plugin to simply match my IAM user with the one in the config and intelligently show only roles that apply to that particular IAM user?

Here is what my config looks like:

[IAM-User-1]
aws_account_id = exampleaccount

[IAM-User-2]
aws_account_id = exampleaccount

[ExampleAcct1]
role_arn = arn:aws:iam::123456789012:role/AssumeRoleTest
source_profile = IAM-User-1

[ExampleAcct2]
role_arn = arn:aws:iam::123456789012:role/AssumeRoleOther
source_profile = IAM-User-2

I use dvorak as my keyboard layout.

When I open the extension and Command-V paste the contents I want into the panel, it immediately closes the panel, and does not work.

BTW, Command-v in dvarak is Command-. on the keyboard.

I have tried this even in an incognito window with only minimal other extensions running, same behavior is observed.

Using configuration like:

[BaseRole]
aws_account_id=my-account-alias
target_role_name=my-cross-account-role

[CrossAccount]
aws_account_id=012345678901
source_profile=BaseRole

...works in Chrome, but in Firefox, it tries to assume "undefined@012345678901"

I used xdotool and a script to edit this automatically. This broke entirely with the latest update it seems.

Hello.
I was wondering if it would be possible to specify a region to go by default for a specified role.
I know this isn't possible from the default AWS role switcher, but perhaps there's some parameter to use in order to make this possible (e.g. the redirect_uri ?).

So, I could set that when switching to a specific role, I would directly go to a specific region, not the region I was before switching to the role.
Something along the following lines, where clicking on the Staging role would switch to the role and directly select the eu-west-1 region:
[Staging]
aws_account_id = 11223344556677
role_name = staging
color=787878
region=eu-west-1

Hello,

I believe I've run into an issue with this extension regarding mutliple base roles, the filtering, and assuming different roles;
Also, I believe that this may be related to #55 in some form.
The environment I'm in is a bit complex, I will attempt to do my best to explain it-

Info:
Ext Version: 0.10.1
Browser: Chrome 72.0.3626.64

Problem:
I am a user at an org which uses an IDP for SSO/SAML/Federated auth/login, I can log into multiple roles in multiple AWS accounts, and those roles have permissions which allow the assuming of other roles, when I attempt to configure this extension to work for me, it appears to break and does not show any roles.

My IDP allows the selection of login to two separate AWS "apps"/tiles/buttons/accounts
Me -> IDP -> "AWS Account 1" OR "AWS Account 2"

If I log into "AWS Account 1" I will be signed into AWS as "acct1rolename/[email protected]" on account "AWS Account 1"

If I log into "AWS Account 2", it logs me in to the AWS console, the console then presents me with two options of which role to act as, "RoleA" or "RoleB" - clicking either will log me into AWS as "Role[A|B]/[email protected]" on account "AWS Account 2"
If I am using "RoleA" - I am able to assume "RoleA" on "AWS Account 2", "RoleA" on "AWS Account 3", and "RoleA" on "AWS Account 4"
If I am using "RoleB" - I am able to assume "RoleB" and "RoleC" on "AWS account 2", "AWS Account 3", and "AWS Account 4"

I've attached a small image to sort of help illustrate what I'm meaning by this.

This is my current config, in a somewhat redacted form.

[Account1-Base]
aws_account_id = account1
color = 00c100

[Account2-Base-RoleA]
aws_account_id = account2

[Account2-Base-RoleB]
aws_account_id = account2


[Account2-RoleA]
source_profile = Account2-Base-RoleA
role_name = RoleA
aws_account_id = account2
color = ff0000

[Account3-RoleA]
source_profile = Account2-Base-RoleA
role_name = RoleA
aws_account_id = account3
color = ff8000

[Account4-RoleA]
source_profile = Account2-Base-RoleA
role_name = RoleA
aws_account_id = account4
color = 006cd9


[Account2-RoleB]
source_profile = Account2-Base-RoleB
role_name = RoleB
aws_account_id = Account2
color = ff0000

[Account2-RoleC]
source_profile = Account2-Base-RoleB
role_name = RoleC
aws_account_id = Account2
color = ff0000

[Account3-RoleB]
source_profile = Account2-Base-RoleB
role_name = RoleB
aws_account_id = Account3
color = ff8000

[Account3-RoleC]
source_profile = Account2-Base-RoleB
role_name = RoleC
aws_account_id = Account3
color = ff8000

[Account4-RoleB]
source_profile = Account2-Base-RoleB
role_name = RoleB
aws_account_id = Account4
color = 006cd9

[Account4-RoleC]
source_profile = Account2-Base-RoleB
role_name = RoleC
aws_account_id = Account4
color = 006cd9

How can I set up the extension to follow this flow?
Thank you in advance if I am missing anything obvious or breaking my config somehow.

Yesterday I was updated my Chrome to latest 75.0.3770.100 (Official Build) (64-bit), and switcher stops to work. I don't see any history when this extension enables. When I disable it, I can see my history.

Hi,

It would be very nice if we could sync the config file using Chrome Sync or Firefox Sync across multiple devices: laptop @ home and laptop @ work.

Thanks!

My AWS config file contains the source_profile directive. Rather than copying and pasting, I have to manually remove this line else aws-extend-switch-roles fails to import

Great extension!

would also like a bit more customizability surrounding highlighting color for accounts

Two issues occur when "Show only matching roles" is checked.

1. If multiple entries for the same account, but with different roles appear in the config, then only the last defined entry will be displayed.
2. If using SAML federation into the base account, no roles show up regardless of whether you use the account alias or account ID for the aws_account_id paramter in the configuration.

Firstly, thank you for useful extension.

Issue type

Feature request

What problem does this feature solve?

Maximum profile is about 40.
Beyond that, the role does not increase.
I would like to add about 100 profiles.

Version:

• AWS Extend Switch Roles: 0.8.0
• Chrome 65.0.3325.181

Steps to reproduce

1. Open Configuration
2. Add profiles

[profile base]
output = json
region = ap-northeast-1
aws_account_id = 000000000000

[profile dev-readonly]
output = json
region = ap-northeast-1
role_arn = arn:aws:iam::100000000000:role/role-readonly
source_profile = base
color = B7CA9D
...

3. Save
4. Refresh browser

It would be nice if region could be defined in the Base Account, and used when referenced by source_profile in others.

[Org2-BaseAccount]
aws_account_id = 222200000000
target_role_name = Developer
region = us-east-1

[Org2-Account1-Developer]
aws_account_id = 222200001111
source_profile = Org2-BaseAccount

Firstly, thanks for this awesome extension! I know that the role history is more to show last used roles, but would it be possible to order by config file or alphabetically?

After created my config all the roles showed up but every time I switch roles I get a 404, but if I click back then I go back to the correct page, after looking around in the request I found this requests : ( just an excerpt of all the request )

https://signin.aws.amazon.com/switchrole 302 Post
https://aws.amazon.com/iam/home?region=us-east-1 301 location: /iam/home/?region=us-east-1 ( note that is an invalid url, it should be home?region=us-east-1)
https://aws.amazon.com/iam/home/?region=us-east-1 404

my guess amazon recently changed that and maybe the extension is no reflecting the change or my config is wrong.

Thanks.

When selecting e.g black color in the configuration, the text remains black.
Original AWS roles black color turned text to white for readability.

I believe it would be very helpful to be able to set even foreground color along-side color which changes background.

Naturally this setting should only be applied to the name of the active role.

Thank you for your work building this extension. I have several AWS accounts and roles and use it very often.

AWS recently added the standard role-switcher UI to AWS GovCloud. This is a request to add support for AWS GovCloud regions.

I am on the new 0.30 version and I tried the new account filter:

[hosting]
aws_account_id = xxxxxxxx

[profile abcd]
role_arn = arn:aws:iam::0123456789:role/myrole
source_profile=hosting
color=eb0118

but the profile is filtered out and the menu empty when logged to that account. What else can I supply to help resolve this?

More info: profiles of the first account are filtered correctly. The problem is with profiles of the second account only

ps: great time saving extension!

Eric

Why the limit?

Thanks for implementing a search box. It would be great if this also supported searching by account ID.

Is it possible to extend the space used for the drop down list to accommodate little bit more space for role's image?

I tried different sizes of the image and it would seem that the image is always scaled down to match width and height which I was not able to figure out - making the image unreadable.

I used this site: https://imgplaceholder.com/ to create a image containing two letters. I used sizes like 100 x 100 and tuned the size all way to 24 x 24, and despite the fact the image looked good in the said site, plugin rendered it to so small (even with 24x24) that I wasn't able to read whats in the image anymore.

I believe AWS updated the Management Console code and I am no longer seeing the list of roles. I'm working with Chrome Version 54.0.2840.71 (64-bit) on a mac. I've included 2 screen shots below and I've blacked out the roles/IAM user name for security purposes.

The first display is when I've disabled "Hide original role history"

The second is with "Hide original role history" enabled

Hi Tilfin,

First of all I would thank you for building this extension tools which make our life easier.

My queries is I tried changing the font color instead of the back ground but could not achieve can you also add that feature as well, it would be great.

Thanks Again.
Sam

Everything is working fine, but if I go to the Configuration Tab, I don't see my configuration. I've been using this most excellent extension for a long time without changing the config.

Could it have not been copied over when things switched from the old pop-up to new tab mechanism?

Setting new developers up with this, I've found that the extension doesn't work until I've added a switch role manually.

You can replicate by clearing all browser cookies and trying to use the extension. It won't work. Add a role manually through the AWS interface (Top Nav -> Switch Role -> Fill form) and the extension will start working.

Please, add bitcoin donation address to the "Donation" section in addition to Paypal.

Thank you

https://github.com/tilfin/aws-extend-switch-roles/wiki/External-API

• AESR can receive the configuration of JSON from a config sender extension.
• If AESR uses the configuration received the configuration from config sender, the textarea in the Settings page tell us that.

For example,

[default]
role_name = something

[foo]
aws_account_id = 000011112222

[bar]
aws_account_id = 000011113333

is equals to

[foo]
aws_account_id = 000011112222
role_name = something

[bar]
aws_account_id = 000011113333
role_name = something

, it is useful when a person has a role with the same name for each AWS account.

I have not investigated why yet but role filter by account breaks when accessing the new dashboard: https://phd.aws.amazon.com/phd/home#/dashboard/open-issues

I have ghost entries in my configuration, even if i remove all entrys in the extension configuration and save it i still have some entrys left in the list, where can these be stored?

(the dot is there to show empty list)

~/.aws/config contains only Profile name and region entry
[profile sfxxxxx]
region = eu-west-1
[profile xxxxteam]
...

Is there a way to set the "external_id" configured on a role?
I've searched the source code but can't find anything.

Background

If you have multi aws accounts, All of switching targets for each base account are always displayed.
The target roles should be filtered by the base account is signed-in.

Specification

• Add base account definition that has aws_account_id to the configuration
• Add source_profile to role account section so as to bind target role and base account.

[baseaccount]
aws_account_id = 000011112222

[targetprofile]
role_arn = arn:aws:iam::123456789012:role/xxxxxxxxx
source_profile = baseaccount

• The targetprofile is only shown in the role list when AWS Account 000011112222 is signed-in.
• The definiction without source_profile is always shown for supporting older version.

Hello,

I get 404 error when I try to download the extension https://chrome.google.com/webstore/detail/aws-extend-switch-roles/

This commit introduced several fishing sites in the code, that will leak your credentials to an attacker dca1764

Roles that I previously listed in my aws-extend-switch-roles configuration still appear in my aws console roles menu. This occurs even when I clear all storage for the aws-console, but does not if I use a new profile. How do I clear data stored by the aws-extend-switch-roles plugin?

Within ~/.mozilla/firefox/<PROFILE>/browser-extension-data/[email protected] there are no files. Additionally, when the extension is remove and re-installed, the problem persists.

User story:
As a user I would like to set my custom display name so that I can recognize roles easier

Description:
When you manually switch a role, AWS console allows you to set a custom display name. Currently the code does this by concat'ing ${role_name}@${account_id}. I disabled the visibility accountId, since that does not tell me much (as a person); so now I only see the role name. However, due to the way things are set up at our project; we have overlapping role names. Therefore I would like to be able to set a custom name, so it's more clear to me to which role I am switching.

I would suggest to add a field to the configuration (e.g.: display_name=foo), which will be visible as display name - but only if it is set. Otherwise, fallback to the default behaviour: ${role_name}[@${account_id}].

If preferred, I could have a look at the code and make a suggestion - however, if you guys think its better / easier to include it by yourselves; please feel free to do so. :-)

Firstly, thank your for your extension. This extension saves me so much time on such a regular basis it is now a default install on all my browsers.

On to my main suggestion: would it be possible to support AWS Toolbar Items? Essentially allowing a user to define regularly used toolbar items (AWS Services) that always get cleared when your browser's cookies/cache is flushed.

I can't tell if AWS is storing this info in a cookie or a session but I'm guessing it can't be too hard to inject?

Would love to hear your thoughts.

On the readme page on Github, the example:

[baseaccount1]
aws_account_id = 000000000000

[targetaccount1]
<snip>

[baseaccount2]
aws_account_id = your-alias-name

is missing the 'profile' keyword. Should be:

[profile baseaccount1]
aws_account_id = 000000000000

[targetaccount1]
<snip>

[profile baseaccount2]
aws_account_id = your-alias-name

Use-case, different profiles has different AWS services used, there for different pinned items can be handy, also as it depends on cookies, new sessions etc can wipe it clean.
The pinned items are stored under the cookie named noflush_awscnm for the domain .console.aws.amazon.com, and it contains a html encoded json object with the following structure.

{
  "hist": [
    "home"
  ],
  "sc": [
    "cfo",
    "cfg",
    "ec2"
  ],
  "tm": "tm-both",
  "ea": true
}

Where the hist, control the dashboard history items, the sc the pinned items on the top of the console, but not sure about the tm and ea.

The format can be something like:

[profile marketingadmin]
role_arn = arn:aws:iam::123456789012:role/marketingadmin
source_profile = default
color = FFF933
sc = cfo,cfg,ec2,etc

Might not needed to modify the hist, and the tm/ea but only the sc, so at the time of switch, decode the existing value of the cookie, modify the sc section encode it and write it back.

Everything is working fine, but if I go to the Configuration Tab, I don't see my configuration. But it clearly has the configuration when I use the switcher. If I disable the extension the switcher no longer shows my setup. And when I re-enable it, my setup is correct.

I've been using this most excellent extension for a long time without changing the config.
Could it have not been copied over when things switched from the old pop-up to new tab mechanism?

Hello, As of today I get HTTP error 400 when trying to switch role, while the "manual" switch role still works.
There might be some change in AWS, because the errors refers to an "old-link"

You are aware of these issues?

If I paste an ~/.aws/config with some source profile references, the add-on stops working. If I filter these references away, it starts working. Is it really necessary to use source profile references?

Thanks a lot for this useful plugin!