Session policies not available for AssumeRoleProviderBuilder?

[fluetm]

I've been looking through the docs, and noted that the AssumeRoleInput includes both a policy or policy_arn that would allow a session policy restriction to be applied. However, the AssumeRoleProviderBuilder doesn't seem to have the ability to set those. It provides for role ARN, session name, and a few other things but doesn't look to include policies.

Was thinking with some small changes like this it could complete the integration, but wasn't sure if I was missing something else or if the policies are deliberately omitted for some reason?

[jdisanti]

I think what we need to do here is directly expose the AssumeRoleInput as part of the AssumeRoleProviderBuilder. Otherwise, if STS adds new fields to the operation, there will be no way to set those fields without a code change to the provider.

I created a feature request to track this: awslabs/aws-sdk-rust#509

If you want to try implementing this yourself, I can guide you through the changes that need to be made.

[fluetm]

I'm new to rust, but I'd give it a go

[jdisanti]

We would love the help!

I think the way to do this would be to add a function to the AssumeRoleProviderBuilder that returns a mutable reference to an underlying AssumeRoleInput builder. To do this, the members of AssumeRoleProviderBuilder would need to be refactored to just a single Builder, except for conf, which is unrelated to the STS call.

The existing builder methods would need to be refactored to set things on this internal builder, and then one new function added to mutable access the internal builder directly. I'm open to naming on that function, but perhaps something like, override_input.

Then instead of constructing the input in the build function, the internal builder would be used directly.

A note on working in this aws-config package with an IDE: You'll need to run ./gradlew aws:sdk:assemble at the root of smithy-rs in order for aws-config to find its aws-sdk-sts dependency, since it uses the code generated STS service crate to make calls for the AssumeRoleProvider.

[rcoh]

We've discussed this internally and realized that we need to avoid exposing a public STS dependency like this. I think we should go through and fully enumerate the available STS params and add all of them to the provider for now.

We may need to also set up a mechanism to automatically ticket us when new parameters need to be added.

This could also be a reason to refactor the way that aws-config works to be more like the Kotlin SDK where they actually code generate a minimal STS client into their config crate directly