Merge pull request getsops#1037 from mozilla/ajvb/limit-role-length

Limit role session name length to 64 characters.
sitedata · Apr 4, 2022 · 0f8c335 · 0f8c335
2 parents 268b5ff + 1bb30e2
commit 0f8c335
Showing 1 changed file with 7 additions and 0 deletions.
diff --git a/kms/keysource.go b/kms/keysource.go
@@ -172,6 +172,13 @@ func (key MasterKey) createStsSession(config aws.Config, sess *session.Session)
 	sanitizedHostname := stsRoleSessionNameRe.ReplaceAllString(hostname, "")
 	stsService := sts.New(sess)
 	name := "sops@" + sanitizedHostname
+
+	// Make sure the name is no longer than 64 characters (role session name length limit from AWS)
+	roleSessionNameLengthLimit := 64
+	if len(name) >= roleSessionNameLengthLimit {
+		name = name[:roleSessionNameLengthLimit]
+	}
+
 	out, err := stsService.AssumeRole(&sts.AssumeRoleInput{
 		RoleArn: &key.Role, RoleSessionName: &name})
 	if err != nil {