AWS re:Postを使用することにより、以下に同意したことになります AWS re:Post 利用規約

ECS task role chaining limitation to 1 hour

0

A customer is running into an error when trying to take the current task role credentials to assume a different role beyond 1 hour. They run into this error message: "ClientError: An error occurred (ValidationError) when calling the AssumeRole operation: The requested DurationSeconds exceeds the 1 hour session limit for roles assumed by role chaining."

I can't seem to find guidance on how a customer should configure the task role credentials duration beyond 1 hour so that assume role chaining can also extend beyond 1 hour. Is that possible?

AWS
質問済み 5年前1341ビュー
1回答
0
承認された回答

I am just working on a container that ran into exactly the same issue. I made an assume role and added the credentials directly to the invocation of a third party lib. In the moment where the credentials timed out, all calls failed.

I found this merge request https://github.com/boto/botocore/pull/1313!

Now, I created a profile with the EcsContainer source:

[profile crossaccount]
role_arn="${CROSS_ACCOUNT_ROLE_ARN}"
credential_source=EcsContainer

I pass this profile to the 3rd party lib instead. Under the hood, this profile is registered in the credentials provider chain which solves the issue.

Best regards

AWS
回答済み 5年前

ログインしていません。 ログイン 回答を投稿する。

優れた回答とは、質問に明確に答え、建設的なフィードバックを提供し、質問者の専門分野におけるスキルの向上を促すものです。

質問に答えるためのガイドライン

関連するコンテンツ