Fix federated user ID parsing #644
Conversation
k8s-ci-robot
added
cncf-cla: yes
k8s-ci-robot
added
the
approved
nckturner
force-pushed
the
fix-userid-parsing
branch
from
22022ae to
de34f89
Compare
| // The user ID is one of: | ||
| // 1. UserID:SessionName (for assumed roles) | ||
| // 2. UserID (for IAM User principals). | ||
| // 3. AWSAccount:CallerSpecifiedName (for federated users) |
There was a problem hiding this comment.
How reliable it is, if this is a caller specified custom name?
There was a problem hiding this comment.
Similar to assumed role session name, although this matches the username I think. But in the case of session name it depends how its used, if you control how a role is assumed and give the credentials to someone else then you can control the session name.
nckturner
force-pushed
the
fix-userid-parsing
branch
5 times, most recently
from
197bc18 to
e70f6a8
Compare
k8s-ci-robot
added
size/XL
* refactor the parsing logic to make it easier
nckturner
force-pushed
the
fix-userid-parsing
branch
from
e70f6a8 to
9fa86f7
Compare
k8s-ci-robot
added
size/L
|
/approve |
k8s-ci-robot
added
the
lgtm
|
[APPROVALNOTIFIER] This PR is APPROVED This pull-request has been approved by: dims, nckturner The full list of commands accepted by this bot can be found here. The pull request process is described here
Needs approval from an approver in each of these files:
Approvers can indicate their approval by writing |
What this PR does / why we need it:
This PR changes the way the federated user ID is treated. Instead of splitting at a colon like we do for assumed-roles, we take the whole value. This is because if we split at the colon, the user ID is just the account number and can't be differentiated from the root user.