使用 AWS re:Post 即表示您同意 AWS re:Post 使用條款

ECS task role chaining limitation to 1 hour

0

A customer is running into an error when trying to take the current task role credentials to assume a different role beyond 1 hour. They run into this error message: "ClientError: An error occurred (ValidationError) when calling the AssumeRole operation: The requested DurationSeconds exceeds the 1 hour session limit for roles assumed by role chaining."

I can't seem to find guidance on how a customer should configure the task role credentials duration beyond 1 hour so that assume role chaining can also extend beyond 1 hour. Is that possible?

AWS
已提問 5 年前檢視次數 1341 次
1 個回答
0
已接受的答案

I am just working on a container that ran into exactly the same issue. I made an assume role and added the credentials directly to the invocation of a third party lib. In the moment where the credentials timed out, all calls failed.

I found this merge request https://github.com/boto/botocore/pull/1313!

Now, I created a profile with the EcsContainer source:

[profile crossaccount]
role_arn="${CROSS_ACCOUNT_ROLE_ARN}"
credential_source=EcsContainer

I pass this profile to the 3rd party lib instead. Under the hood, this profile is registered in the credentials provider chain which solves the issue.

Best regards

AWS
已回答 5 年前

您尚未登入。 登入 去張貼答案。

一個好的回答可以清楚地回答問題並提供建設性的意見回饋,同時有助於提問者的專業成長。

回答問題指南