AWS STS token refresh with existing token received from AssumeRoleWithSAML

Question

I have a use-case where I need to have temporary AWS STS token made available for each authenticated user (auth using company IDP). These tokens will be used to push some data in AWS S3. I am able to get this flow, by using SAML assertion in IDP response and integrating with AWS as SP (IDP initiated sign-on) similar to one shown here.

https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_providers_saml.html#CreatingSAML-configuring

But as STS allows token validity to be max for 1 hour, I want to refresh those tokens before expiry so that I don't have to prompt user to give credentials again (bad user experience). Also as these are company login credentials, I cant store them in the application.

I was looking at AWS IAM trust policy, and one way to do this is adding 'AssumeRole' entry to the existing SAML trust policy as shown below (second entry in the policy)

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": {
        "Federated": "arn:aws:iam::xxxxxxxxxxxx:saml-provider/myidp.com"
      },
      "Action": "sts:AssumeRoleWithSAML",
      "Condition": {
        "StringEquals": {
          "SAML:aud": "https://signin.aws.amazon.com/saml"
        }
      }
    },
    {
      "Effect": "Allow",
      "Principal": {
        "AWS": "arn:aws:sts::xxxxxxxxxxxx:assumed-role/testapp/testuser"
      },
      "Action": "sts:AssumeRole"
    }
  ]
}

So for first time when testuser logs in as uses AssumeRoleWithSAML API/CLI, he will get temporary credentials. Next, he can use 'AssumeRole' API/CLI with those credentials, so that he can keep on refreshing the tokens without requires IDP credentials.

As can be seen, this works only for STS user with ARN of "arn:aws:sts::xxxxxxxxxxxx:assumed-role/testapp/testuser" for refreshing tokens as he/she can assume that role. but I need a generic way, where for any logged in user, he can generate STS tokens.

One way is to use wildcard characters in Trust policy for Principal, but looks like it is not supported. So I am stuck with tacking credentials every time the tokens expire. Is there a way to solve this?

thanks, Rohan.

its not possible with IAM policies, If using, python botocore exposes api called RefreshableCredentials...check this github.com/boto/boto3/issues/443 — Sudharsan Sivasankaran
thanks Sudhakar. I checked that and also gist.github.com/JoeyG1973/69ae503f67ff7f07b498b2e53226e206, which is for Assume role with SAML. But I think it requires the username/password to be available as well? — Rohan Pandit

Samuel Lannoy Samuel Lannoy · Accepted Answer · 2020-01-08T14:06:27

I have been able to get this working by specifying a role instead of an assumed-role in the IAM trust policy. Now my users can indefinitely refresh their tokens if they have assumed the testapp role.

"Principal": {
  "AWS": "arn:aws:sts::xxxxxxxxxxxx:role/testapp"
},

AWS STS token refresh with existing token received from AssumeRoleWithSAML

2 Answers