missing session_ttl option?

[chizou]

There are environment variables AWS_SESSION_TTL and AWS_ASSUME_ROLE_TTL. The config file option for assume_role_ttl exists but there doesn't seem to be a matching option for session_ttl. Is this expected?

Admittedly, I'm not completely certain what the difference between the two are so can that also be explained?

[sdann]

I second this lack of a session_ttl config parameter. I've just discovered that cred-process takes the min() of the configured AWS and Okta session. Thus, setting assume_role_ttl alone in config is useless.

For example on 0.27.0:

aws-okta cred-process -a 8h test
Returns a 1 hour STS token, because the default for session_ttl is 1 hour.

aws-okta cred-process -a 8h -t 8h test
Returns an 8 hour STS token.

aws-okta cred-process -a 8h -t 4h test
Returns a 4 hour STS token, the min() of the 2.

I could work around this in the config file if session_ttl was supported.

[sdann]

After diving through the code, I now understand that:

session_ttl is the duration of the STS creds for the initial AssumeRoleWithSAML() call.
assume_role_ttl is the duration of the creds for any secondary role that is assumed after the first.

This was very confusing at first. I had assumed session_ttl was the length of the Okta login session or Oka SAML assertion ttl.

@nickatsegment Question: why have 2 different names? Since the tool is only ever assuming 1 final role eventually, why not use the same config parameter for both? Say session_ttl which will always be the TTL for the STS token regardless of whether it was assumed with AssumeRoleWithSAML() or AssumeRole()?

[nickatsegment]

That nomenclature predates my tenure at aws-okta :) I'm not really aware of any use cases where you'd want different values for these. Possibly the STS creds associated with session_ttl are reusable if you assume a different role? Maybe @Fauzyy has some ideas

[sdann]

PR to fix this issue: #255
New issue to address the similar parameter names: #256

[nickatsegment]

#278