luxolus
/
open-vault
2
0
Fork 0
Code Issues 1 Pull Requests Releases Activity

[VAULT-1986] Cap AWS Token TTL based on Default Lease TTL (#12026) 

* fix: cap token TTL at login time based on default lease TTL

* add changelog file

* patch: update warning messages to not include 'at login'

* patch: remove default lease capping and test

* update changelog

* patch: revert warning message
This commit is contained in:
vinay-gopalan 2021-07-15 10:05:38 -07:00 committed by GitHub
parent f027a1b1ff
commit c20b5f1040
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
3 changed files with 5 additions and 6 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
builtin/credential/aws/path_role.go
View File

@ -889,11 +889,7 @@ func (b *backend) pathRoleCreateUpdate(ctx context.Context, req *logical.Request
} }
} }
defaultLeaseTTL := b.System().DefaultLeaseTTL()
systemMaxTTL := b.System().MaxLeaseTTL() systemMaxTTL := b.System().MaxLeaseTTL()
if roleEntry.TokenTTL > defaultLeaseTTL {
resp.AddWarning(fmt.Sprintf("Given ttl of %d seconds greater than current mount/system default of %d seconds; ttl will be capped at login time", roleEntry.TokenTTL/time.Second, defaultLeaseTTL/time.Second))
}
if roleEntry.TokenMaxTTL > systemMaxTTL { if roleEntry.TokenMaxTTL > systemMaxTTL {
resp.AddWarning(fmt.Sprintf("Given max ttl of %d seconds greater than current mount/system default of %d seconds; max ttl will be capped at login time", roleEntry.TokenMaxTTL/time.Second, systemMaxTTL/time.Second)) resp.AddWarning(fmt.Sprintf("Given max ttl of %d seconds greater than current mount/system default of %d seconds; max ttl will be capped at login time", roleEntry.TokenMaxTTL/time.Second, systemMaxTTL/time.Second))
} }

4
builtin/credential/aws/path_role_test.go
View File

@ -762,10 +762,10 @@ func TestAwsEc2_RoleDurationSeconds(t *testing.T) {
} }
if resp.Data["ttl"].(int64) != 10 { if resp.Data["ttl"].(int64) != 10 {
t.Fatalf("bad: period; expected: 10, actual: %d", resp.Data["ttl"]) t.Fatalf("bad: ttl; expected: 10, actual: %d", resp.Data["ttl"])
} }
if resp.Data["max_ttl"].(int64) != 20 { if resp.Data["max_ttl"].(int64) != 20 {
t.Fatalf("bad: period; expected: 20, actual: %d", resp.Data["max_ttl"]) t.Fatalf("bad: max_ttl; expected: 20, actual: %d", resp.Data["max_ttl"])
} }
if resp.Data["period"].(int64) != 30 { if resp.Data["period"].(int64) != 30 {
t.Fatalf("bad: period; expected: 30, actual: %d", resp.Data["period"]) t.Fatalf("bad: period; expected: 30, actual: %d", resp.Data["period"])

3
changelog/12026.txt Normal file
View File

@ -0,0 +1,3 @@
```release-note:bug
auth/aws: Remove warning stating AWS Token TTL will be capped by the Default Lease TTL.
```