44833 Truncate AssumeRole session name to API limits

lib/srv/app/cloud.go

@@ -191,7 +191,7 @@ func (c *cloud) getAWSSigninToken(ctx context.Context, req *AWSSigninRequest, en
 	options = append(options, func(creds *stscreds.AssumeRoleProvider) {
 		// Setting role session name to Teleport username will allow to
 		// associate CloudTrail events with the Teleport user.
-		creds.RoleSessionName = req.Identity.Username
+		creds.RoleSessionName = awsutils.TruncateRoleSessionName(req.Identity.Username)
 
 		// Setting web console session duration through AssumeRole call for AWS
 		// sessions with temporary credentials.

lib/utils/aws/aws.go

@@ -68,6 +68,9 @@ const (
 	AmzJSON1_0 = "application/x-amz-json-1.0"
 	// AmzJSON1_1 is an AWS Content-Type header that indicates the media type is JSON.
 	AmzJSON1_1 = "application/x-amz-json-1.1"
+
+	// MaxRoleSessionName is the maximum length of the role session name used by the AssumeRole call.
+	MaxRoleSessionName = 64
 )
 
 // SigV4 contains parsed content of the AWS Authorization header.
@@ -484,3 +487,11 @@ func iamResourceARN(partition, accountID, resourceType, resourceName string) str
 		Resource:  fmt.Sprintf("%s/%s", resourceType, resourceName),
 	}.String()
 }
+
+// TruncateRoleSessionName truncates the role session name to AWS character limit (64).
+func TruncateRoleSessionName(roleSessionName string) string {
+	if len(roleSessionName) > MaxRoleSessionName {
+		return roleSessionName[:MaxRoleSessionName]
+	}
+	return roleSessionName
+}

lib/utils/aws/aws_test.go

@@ -493,3 +493,26 @@ func TestResourceARN(t *testing.T) {
 		})
 	}
 }
+
+func TestTruncateRoleSessionName(t *testing.T) {
+	for _, tt := range []struct {
+		name     string
+		role     string
+		expected string
+	}{
+		{
+			name:     "role session name not truncated, less than 64 characters",
+			role:     "MyRole",
+			expected: "MyRole",
+		},
+		{
+			name:     "role session name truncated, longer than 64 characters",
+			role:     "remote-raimundo.oliveira@abigcompany.com-teleport.abigcompany.com",
+			expected: "[email protected]",
+		},
+	} {
+		t.Run(tt.name, func(t *testing.T) {
+			require.Equal(t, tt.expected, TruncateRoleSessionName(tt.role))
+		})
+	}
+}

lib/utils/aws/credentials.go

@@ -74,7 +74,7 @@ func (g *credentialsGetter) Get(_ context.Context, request GetCredentialsRequest
 	logrus.Debugf("Creating STS session %q for %q.", request.SessionName, request.RoleARN)
 	return stscreds.NewCredentials(request.Provider, request.RoleARN,
 		func(cred *stscreds.AssumeRoleProvider) {
-			cred.RoleSessionName = request.SessionName
+			cred.RoleSessionName = TruncateRoleSessionName(request.SessionName)
 			cred.Expiry.SetExpiration(request.Expiry, 0)
 
 			if request.ExternalID != "" {