aws-iam-authenticator
aws-iam-authenticator copied to clipboard
feat: add processCredentialTimeout option to token command
This update introduces a new flag --process-credential-timeout to the token command, allowing users to specify a timeout for the AWS credential_process execution. The timeout value can be set to a positive duration, overriding the SDK's default of 1 minute. The change includes updates to the GetTokenOptions struct and the associated binding in the command initialization.
What this PR does / why we need it:
- Adds an optional
--process-credential-timeoutflag to thetokencommand to control the AWScredential_processtimeout. - Plumbs the flag through
GetTokenOptions.ProcessCredentialTimeoutand applies it viaconfig.WithProcessCredentialOptionsto setprocesscreds.Options.Timeout. - Default behavior is unchanged: if the flag is omitted or set to
0, the SDK’s default (1 minute) is used. - Needed for environments where dual-control approval flows routinely exceed 60s; reduces spurious “credential process timed out” failures.
Implementation highlights:
pkg/token/token.go: addedProcessCredentialTimeout time.DurationtoGetTokenOptions; set timeout inLoadDefaultConfigwhen > 0.cmd/aws-iam-authenticator/token.go: added--process-credential-timeoutflag (Duration), bound with viper, and passed toGetTokenOptions.- No server-side changes; purely client-side and backward-compatible.
Testing:
- I verified no timeout at 60s with flag.
- Omit the flag to confirm behavior remains unchanged.
Testing Proof Without Flag
❯ WS_PROFILE=xyz--cluster-admin ./_output/bin/aws-iam-authenticator_v0.7.8_darwin_arm64 token --cluster-id prod-green --cache --log-verbosity error
This AWS role has dual-control enabled. To continue, please have someone approve your AWS access request before it expires:
https://.../v1/...?defer=yes
State Expires in Refresh in
pending 29m1s 2s
could not get token: operation error STS: GetCallerIdentity, get identity: get credentials: failed to refresh cached credentials, process provider error: credential process timed out: signal: killed
With Flag
❯ AWS_PROFILE=xyz--cluster-admin ./_output/bin/aws-iam-authenticator_v0.7.8_darwin_arm64 token --cluster-id prod-green --cache --log-verbosity error --process-credential-timeout="5m"
This AWS role has dual-control enabled. To continue, please have someone approve your AWS access request before it expires:
https://.../v1/...?defer=yes
State Expires in Refresh in
pending 27m56s 3s
// does not exit after 1 minute
Release note:
- Add
--process-credential-timeouttoaws-iam-authenticator tokento override the default 1-minute AWS credential_process timeout.