diff --git a/README.md b/README.md index 954b8f413..1f538aa1a 100644 --- a/README.md +++ b/README.md @@ -174,6 +174,7 @@ const interceptor = aws4Interceptor({ region: "eu-west-2", service: "execute-api", assumeRoleArn: "arn:aws:iam::111111111111:role/MyRole", + assumeRoleSessionName: "MyApiClient", // optional, default value is "axios" }, }); ``` diff --git a/src/credentials/assumeRoleCredentialsProvider.ts b/src/credentials/assumeRoleCredentialsProvider.ts index b8aad97d1..975caa6ed 100644 --- a/src/credentials/assumeRoleCredentialsProvider.ts +++ b/src/credentials/assumeRoleCredentialsProvider.ts @@ -17,6 +17,7 @@ export class AssumeRoleCredentialsProvider implements CredentialsProvider { ...options, region: options.region || process.env.AWS_REGION, expirationMarginSec: options.expirationMarginSec || 5, + roleSessionName: options.roleSessionName || "axios", }; this.sts = new STSClient({ region: this.options.region }); @@ -48,7 +49,7 @@ export class AssumeRoleCredentialsProvider implements CredentialsProvider { const res = await this.sts.send( new AssumeRoleCommand({ RoleArn: this.options.roleArn, - RoleSessionName: "axios", + RoleSessionName: this.options.roleSessionName, }) ); @@ -64,10 +65,12 @@ export interface AssumeRoleCredentialsProviderOptions { roleArn: string; region?: string; expirationMarginSec?: number; + roleSessionName?: string; } export interface ResolvedAssumeRoleCredentialsProviderOptions { roleArn: string; region?: string; expirationMarginSec: number; + roleSessionName: string; } diff --git a/src/interceptor.ts b/src/interceptor.ts index 171b51786..5ca593704 100644 --- a/src/interceptor.ts +++ b/src/interceptor.ts @@ -38,6 +38,14 @@ export interface InterceptorOptions { * Used only if assumeRoleArn is provided. */ assumedRoleExpirationMarginSec?: number; + /** + * An identifier for the assumed role session. + * Use the role session name to uniquely identify a session when the same role is + * assumed by different principals or for different reasons. + * In cross-account scenarios, the role session name is visible to, + * and can be logged by the account that owns the role. + */ + assumeRoleSessionName?: string; } export interface SigningOptions { @@ -106,6 +114,7 @@ export const aws4Interceptor = ({ roleArn: options.assumeRoleArn, region: options.region, expirationMarginSec: options.assumedRoleExpirationMarginSec, + roleSessionName: options.assumeRoleSessionName, }); } else { credentialsProvider = new SimpleCredentialsProvider(credentials);