Ability to authenticate with config profiles or custom session credentials

[Tochey]

Correct me if i am wrong but the only way of authenticating with control tower and other services is by a role arn which then uses your configured default aws profile to assume the role. It would be great to have other methods of authenticating with these services like config profiles and even custom session credentials. ex : {"sessionId": "", "sessionKey": "", "sessionToken": ""}

[costastf]

Hi @Tochey , thanks for this message. Control tower does not expose an official API yet and that is the whole point of this library, to provide an api. That means that the way to authenticate with control tower is to piggyback on the web front end authentication so our only option is roles that can be assumed by the logged in user with his/hers/theirs credentials. I hope this makes sense. If I misunderstood something please let me know.

[iainelder]

Does ControlTower have to assume a role to work with the internal API? Is there some reason it can't use the default Session()?

I log into my management account using the AWSAdministratorAccess role generated by Identity Center.

When I try to use the ARN of that role, I get an InvalidCredentials error.

tower = ControlTower("arn:aws:iam::111111111111:role/aws-reserved/sso.amazonaws.com/AWSReservedSSO_AWSAdministratorAccess_aaaaaaaaaaaaaaaa")

InvalidCredentials: An error occurred (AccessDenied) when calling the AssumeRole operation: User: arn:aws:iam::111111111111:role/aws-reserved/sso.amazonaws.com/AWSReservedSSO_AWSAdministratorAccess_aaaaaaaaaaaaaaaa/... is not authorized to perform: sts:AssumeRole on resource: arn:aws:iam::111111111111:role/aws-reserved/sso.amazonaws.com/AWSReservedSSO_AWSAdministratorAccess_aaaaaaaaaaaaaaaa

That makes sense because the role cannot assume itself. But I don't understand why a new role assumption is necessary.

The workaround for now is to create an extra stack in my management account with a role whose trust policy allows it to be assumed by the AWSAdministratorAccess role. The template may look like this:

  AwsApiLibRole:
      Type: AWS::IAM::Role
      Properties:
        RoleName: AwsApiLib
        AssumeRolePolicyDocument:
          Version: "2012-10-17"
          Statement:
            - Effect: Allow
              Principal:
                AWS: arn:aws:iam::111111111111:role/aws-reserved/sso.amazonaws.com/AWSReservedSSO_AWSAdministratorAccess_aaaaaaaaaaaaaaaa)
              Action: sts:AssumeRole
        ManagedPolicyArns:
          - "arn:aws:iam::aws:policy/AdministratorAccess"

When that resource is created I can use the ControlTower class like this:

tower = ControlTower("arn:aws:iam::111111111111:role/AwsApiLib")

But as @Tochey says it would be more convenient to use the existing session.