boto3-refresh-session only supports AssumeRole. In the vast majority of use cases, this is completely sufficient. Now that boto3-refresh-session is the core dependency for elhaz, however, the absence of support for AssumeRoleWithWebIdentity and AssumeRoleWithSAML can be glaring.
Generally speaking, adding support for these new features should be straight-forward. One exception comes to mind, however: the WebIdentityToken parameter for AssumeRoleWithWebIdentity. This parameter can be tricky. Generally speaking, users update the AWS_WEB_IDENTITY_TOKEN_FILE environment variable so that tokens are read from a file path. Additionally, AWS profiles handle web_identity_token_file. In other words, users seldom provide an argument for the WebIdentityToken parameter manually and directly; however, there are cases where that is not so. Initial release should probably only support str entries; however, in a future release, it may be prudent to also support providing a callable in order to support edge cases.
boto3-refresh-session only supports
AssumeRole. In the vast majority of use cases, this is completely sufficient. Now that boto3-refresh-session is the core dependency for elhaz, however, the absence of support forAssumeRoleWithWebIdentityandAssumeRoleWithSAMLcan be glaring.Generally speaking, adding support for these new features should be straight-forward. One exception comes to mind, however: the
WebIdentityTokenparameter forAssumeRoleWithWebIdentity. This parameter can be tricky. Generally speaking, users update theAWS_WEB_IDENTITY_TOKEN_FILEenvironment variable so that tokens are read from a file path. Additionally, AWS profiles handleweb_identity_token_file. In other words, users seldom provide an argument for theWebIdentityTokenparameter manually and directly; however, there are cases where that is not so. Initial release should probably only supportstrentries; however, in a future release, it may be prudent to also support providing acallablein order to support edge cases.