You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
I'm looking into the use of apprise in CICD tooling. In our environment we don't allow long lived credentials of any kind. Because apprise manually builds a call to the aws rest api, we cant rely on normal sdk behaviour (machine roles, environment vars etc). So support for Session Tokens in the api request is needed so we can utilise short lived credentials. In our case these will come from vault aws secrets engine using assumed_role or session_token.
According to AWS docs Calling against the api with short lived credentials just requires the addition of an extra header X-Amz-Security-Token. This header needs to be in the canonical headers of the signature
In the case of SES, I think it just needs to be added to this array?
The session_token would need to be provided to apprise, but I'm not sure what the convention is for an optional input like this, whether it would need to be part of the url, provided as an argument to the cli, present as an environment variable etc. (Hence why this isnt a PR from me at this stage)
🔨 Breaking Feature
This wouldnt break any current implementation afaik.
The text was updated successfully, but these errors were encountered:
Sure, sounds good. Is this something thats fairly straight forward to do? I'm happy to look into making a PR but if its something you can knock out fast thats probably more efficient.
💡 Session Token Support
I'm looking into the use of apprise in CICD tooling. In our environment we don't allow long lived credentials of any kind. Because apprise manually builds a call to the aws rest api, we cant rely on normal sdk behaviour (machine roles, environment vars etc). So support for Session Tokens in the api request is needed so we can utilise short lived credentials. In our case these will come from vault aws secrets engine using
assumed_role
orsession_token
.According to AWS docs Calling against the api with short lived credentials just requires the addition of an extra header
X-Amz-Security-Token
. This header needs to be in the canonical headers of the signatureIn the case of SES, I think it just needs to be added to this array?
The session_token would need to be provided to apprise, but I'm not sure what the convention is for an optional input like this, whether it would need to be part of the url, provided as an argument to the cli, present as an environment variable etc. (Hence why this isnt a PR from me at this stage)
🔨 Breaking Feature
This wouldnt break any current implementation afaik.
The text was updated successfully, but these errors were encountered: