AWS STS token refresh with existing token received from AssumeRoleWithSAML

Question

I have a use-case where I need to have temporary AWS STS token made available for each authenticated user (auth using company IDP). These tokens will be used to push some data in AWS S3. I am able to get this flow, by using SAML assertion in IDP response and integrating with AWS as SP (IDP initiated sign-on) similar to one shown here.

https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_providers_saml.html#CreatingSAML-configuring

But as STS allows token validity to be max for 1 hour, I want to refresh those tokens before expiry so that I don't have to prompt user to give credentials again (bad user experience). Also as these are company login credentials, I cant store them in the application.

I was looking at AWS IAM trust policy, and one way to do this is adding 'AssumeRole' entry to the existing SAML trust policy as shown below (second entry in the policy)

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": {
        "Federated": "arn:aws:iam::xxxxxxxxxxxx:saml-provider/myidp.com"
      },
      "Action": "sts:AssumeRoleWithSAML",
      "Condition": {
        "StringEquals": {
          "SAML:aud": "https://signin.aws.amazon.com/saml"
        }
      }
    },
    {
      "Effect": "Allow",
      "Principal": {
        "AWS": "arn:aws:sts::xxxxxxxxxxxx:assumed-role/testapp/testuser"
      },
      "Action": "sts:AssumeRole"
    }
  ]
}

So for first time when testuser logs in as uses AssumeRoleWithSAML API/CLI, he will get temporary credentials. Next, he can use 'AssumeRole' API/CLI with those credentials, so that he can keep on refreshing the tokens without requires IDP credentials.

As can be seen, this works only for STS user with ARN of "arn:aws:sts::xxxxxxxxxxxx:assumed-role/testapp/testuser" for refreshing tokens as he/she can assume that role. but I need a generic way, where for any logged in user, he can generate STS tokens.

One way is to use wildcard characters in Trust policy for Principal, but looks like it is not supported. So I am stuck with tacking credentials every time the tokens expire. Is there a way to solve this?

thanks, Rohan.

its not possible with IAM policies, If using, python botocore exposes api called RefreshableCredentials...check this https://github.com/boto/boto3/issues/443 — Sudharsan Sivasankaran, Mar 16 '18 at 17:09
thanks Sudhakar. I checked that and also https://gist.github.com/JoeyG1973/69ae503f67ff7f07b498b2e53226e206, which is for Assume role with SAML. But I think it requires the username/password to be available as well? — Rohan Pandit, Mar 19 '18 at 06:31

score 2 · Answer 1 · answered Jan 08 '20 at 14:06

I have been able to get this working by specifying a role instead of an assumed-role in the IAM trust policy. Now my users can indefinitely refresh their tokens if they have assumed the testapp role.

"Principal": {
  "AWS": "arn:aws:sts::xxxxxxxxxxxx:role/testapp"
},

score 0 · Answer 2 · answered Jun 08 '18 at 19:04

AWS STS supports longer role sessions (up to 12 hours) for the AssumeRole* APIs. This was launched on 3/28/18, here is the AWS whats-new link: https://aws.amazon.com/about-aws/whats-new/2018/03/longer-role-sessions/. By that you need not to do a refresh as I assume a typical workday is < 12 hours :-)

score 0 · Answer 3 · answered Oct 20 '21 at 22:48

Your question is one I was working on solving myself, we have a WPF Desktop Application that is attempting to log into AWS through Okta, then use the AssumeRoleWithSaml API to get the STS Token.

Using this flow invoked the Role Chaining rules and thus our token would expire every hour.

What I did to overcome this is to cache the initial SAMLResponse Data from Okta (after the user does MFA) and use that information to ask for a new Token every 55 minutes. I then use that new token for any future AWS resource calls.

Once 12 hours passes, I ask the user to authenticate with Okta again.

For those wondering about implementation for their own WPF apps, we use the AWS Account Federation App in Okta.

The application uses 2 packages:

After setting up your AWS Account Federation App in Okta, use the AWS Embed Url and SAML Redirect Url in your application to get your SAMLResponse data.

AWS STS token refresh with existing token received from AssumeRoleWithSAML

3 Answers3