Feature request: AWS-vault - auto-refresh temporary credentials

[Leigh-M]

Describe your idea/feature/enhancement

AWS-vault is almost essential when developing daily with AWS SAM (especially sam sync) with MFA set up (best practice of course) you use it like:

aws-vault exec some-profile -- sam sync --watch --stack-name some-stack --region eu-west-1 --parameter-overrides EnvType=dev

This means that it can assume a role using your credentials without MFA over the next say 8 hours - so you don't have to use your MFA device every hour! That was life-changing.. ;-)

However.. the temp credentials expire every hour.. (you don't need your MFA device which is a huge improvement..) but still leads once per hour having to escape the 'sam sync' in the terminal.. and re-run the aws-vault exec.... command. So on an 8-12 hours day.. that's about 8 - 12 annoyances.. and at least 30 mins lost time!

Proposal

Please can AWS SAM be aware of the temp credentials' expiry time, and either:

1. Check credentials expiry time and refresh 2 mins before they expire
2. Set an override to auto-refresh every say 58 mins (hard-coded/ passed value) - so it's good to go when you sync a change via sam sync
3. Or on credentials failure then auto-refresh

The actual error thrown on credentials expiry, in case it's useful is:

Code sync encountered an error.
Traceback (most recent call last):
  File "samcli/lib/sync/sync_flow_executor.py", line 335, in _sync_flow_execute_wrapper
  File "samcli/lib/sync/sync_flow.py", line 312, in execute
  File "samcli/lib/sync/flows/zip_function_sync_flow.py", line 107, in compare_remote
  File "botocore/client.py", line 401, in _api_call
  File "botocore/client.py", line 731, in _make_api_call
botocore.exceptions.ClientError: An error occurred (ExpiredTokenException) when calling the GetFunction operation: The security token included in the request is expired

Thank you! :-)

[jfuss]

@Leigh-M Thanks for the feature request and bringing up the issue. This seems like a good addition to make the experience better. I know we did something (long ago) with MFA for credentials in a different context, I think for sam local start-api/mounting creds into the container. I wonder if we could just re-use that.

Is this something you are passionate about and want to contribute? I ask because I am not sure when the team would be able to get to the request. If not, no big deal but if you do, I can try to do more digging up front to see what we have done in the past for MFA and see if that will work in this case too.

[Leigh-M]

Hi @jfuss!

Thanks for your reply, I can have a look into it, (time always the issue as usual!) - but yes if there is anything you can root out to give me a start at least and any additional info that would be great! Thanks

[jfuss]

@Leigh-M Sounds good. I'll take a deeper look and find some things to link you to later today.

[jfuss]

@Leigh-M Sorry for the delay on my part. I found the old PR where we added something similar: #1744. I think this should work for sync as well. We might just be able to re-use this?