Fix AWS MFA for roles assumed through a source profile

[AJaccP]

Overview

When a profile assumes a role through a source_profile, resolveLocalAnd1PasswordConfigurations gives every profile in the chain the item's MFA serial and one-time password. So the source profile already resolved to an MFA GetSessionToken provider, and NewAssumeRoleProvider then wrapped it in a second one. That second call is signed with the first call's session credentials, which AWS rejects with Cannot call GetSessionToken with session credentials. It only failed when nothing was cached: a cached MFA or role session skips both calls, which is why it worked intermittently, and why running a command against the default profile first appeared to fix it. Chains through more than one role were broken the same way.

MFA is now applied once, to the long-lived access keys at the root of the source_profile chain, and NewAssumeRoleProvider no longer adds it. MFA settings found on any profile in the chain are carried down to the root, so an mfa_serial set only on the role profile still applies. Roles without a source_profile and MFA-only profiles build the same chain as before, and cache keys are unchanged.

Type of change

• Created a new plugin
• Improved an existing plugin
• Fixed a bug in an existing plugin
• Improved contributor utilities or experience

Related Issue(s)

• Resolves: AWS plugin fails with MFA #559

How To Test

Unit tests, including a regression test for the reported bug:

go test ./plugins/aws/ -v

TestSTSProviderChain builds the provider chain with the real factory and an empty cache, then asserts the STS calls it makes. It checks for a single MFA GetSessionToken in four cases: the reported source_profile setup, a role without a source_profile, a role chained through another role, and an mfa_serial set only on the role profile. The existing TestSTSProvisioner cases use a mock factory that ignores the source provider, which is why they didn't catch this.

End to end with the CLI, using an item with access keys, a one-time password and an MFA serial, and a role the IAM user can assume:

[profile 1pass-source-profile]
region = eu-west-1

[profile my-1password-profile]
source_profile = 1pass-source-profile
role_arn       = arn:aws:iam::<account>:role/<role>
region         = eu-west-1

aws sts get-caller-identity --profile my-1password-profile

Note: Run it more than 15 minutes after your last aws command so nothing is cached. This failed with Cannot call GetSessionToken with session credentials before the change and should now return the assumed role. aws sts get-caller-identity with the default profile should still return the IAM user.

Changelog

The AWS plugin no longer fails with Cannot call GetSessionToken with session credentials when a profile with MFA assumes a role through a source_profile.

[JillRegan]

LGTM!