Cross account role chaining for non-sso managed IAM roles...

[wealdling]

I'm not sure if I'm just not understanding the documentation, or if I am misreading the ability to do this. I have an IAM role with a trust relationship established to an SSO managed Role in a different account. I've tried accomplishing this with the "via" key, only defining the parent role in the other account, referencing the accountID:role as a value, referencing the accountFriendlyName:role as a value, all to no avail.

I've also tried to setup the prescribed .aws/config entry with source_profile pointing to the managed SSO Role, then running config-setup, with no success.

Given that it seems you're leveraging STS Assume Role recursively, I think this should be something that just works. Am I missing how to accomplish it/doing something wrong, or is this a valid feature request? I'd like to be able to run aws-sso eval unmanagedProfile and have it login via the referenced SSO managed account, then assume the unmanaged role and provide exports as normal.

[synfinatic]

You're missing lots of useful info. Please fill out the appropriate form: https://github.com/synfinatic/aws-sso-cli/issues/new?assignees=&labels=bug&projects=&template=bug_report.md&title=

[timoguin]

I've done this in the past with aws-sso-cli but have been struggling with the appropriate config for the last few days.

For my use case, I'm wanting to utilize an SSO role in the AWS Organizations management account to assume the OrganizationsAccountAccessRole into every other account.

This is quite a simple thing, but I can't seem to figure out the proper configuration syntax for aws-sso-cli. The current examples in the documentation aren't sufficient enough for me to understand what I'm doing wrong.

I think some general role-chaining guidance for this use case would be super helpful. I've been having to dive into the code to figure out what I'm doing wrong.

[timoguin]

BTW, here's a snippet of my configuration (I've tried a bunch of variants so far):

SSOConfig:
  Default:
    Accounts:
      # AWS Organizations mgmt account
      "123456789012":
        Name: root
        Roles:
          workload-another-account:
            Via: "arn:aws:iam::111111111111:role/OrganizationsAccountAccessRole"
          workload-another-account-2:
            Via: "arn:aws:iam::222222222222:role/OrganizationsAccountAccessRole"

I expected this to surface those roles with doing aws-sso list, but it doesn't. What is the right way to do this? I feel dum. 😆