{"action":"created","issue":{"url":"https://api.github.com/repos/physera/onelogin-aws-cli/issues/119","repository_url":"https://api.github.com/repos/physera/onelogin-aws-cli","labels_url":"https://api.github.com/repos/physera/onelogin-aws-cli/issues/119/labels{/name}","comments_url":"https://api.github.com/repos/physera/onelogin-aws-cli/issues/119/comments","events_url":"https://api.github.com/repos/physera/onelogin-aws-cli/issues/119/events","html_url":"https://github.com/physera/onelogin-aws-cli/issues/119","id":328465830,"node_id":"MDU6SXNzdWUzMjg0NjU4MzA=","number":119,"title":"Feature: Background task that refreshes session periodically","user":{"login":"thnee","id":51159,"node_id":"MDQ6VXNlcjUxMTU5","avatar_url":"https://avatars1.githubusercontent.com/u/51159?v=4","gravatar_id":"","url":"https://api.github.com/users/thnee","html_url":"https://github.com/thnee","followers_url":"https://api.github.com/users/thnee/followers","following_url":"https://api.github.com/users/thnee/following{/other_user}","gists_url":"https://api.github.com/users/thnee/gists{/gist_id}","starred_url":"https://api.github.com/users/thnee/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/thnee/subscriptions","organizations_url":"https://api.github.com/users/thnee/orgs","repos_url":"https://api.github.com/users/thnee/repos","events_url":"https://api.github.com/users/thnee/events{/privacy}","received_events_url":"https://api.github.com/users/thnee/received_events","type":"User","site_admin":false},"labels":[],"state":"closed","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":3,"created_at":"2018-06-01T10:30:09Z","updated_at":"2018-06-27T15:23:47Z","closed_at":"2018-06-27T15:23:47Z","author_association":"CONTRIBUTOR","body":"## Problem\r\n\r\nIn our organization, we have a hard requirement from regulation that basically says \"idle login sessions must be automatically timed out after 15 minutes\".\r\n\r\nAlthough this can be annoying, it is still functional as long as a login session is active in nature, for example an SSH session keeps being active as long as you are using it.\r\n\r\nHowever, since `onelogin-aws-cli` is passive in nature, this does turn into a very real problem. If some automation tool is running a long process for more than 15 minutes, the session will time out while the tool is running, breaking the workflow, which may not be recoverable. For example, building AMI's with Packer can definitely take quite some time.\r\n\r\n## --renew-seconds\r\n\r\nI see that `onelogin-aws-cli` used to have a flag called `--renew-seconds`. However, as far as I can tell from the code, that feature had the drawback of running in the foreground and occupying the terminal.\r\n\r\n## Fork off and die\r\n\r\nI think a better way to implement session refreshing would be to fork off a background process and let the `onelogin-aws-login` program finish and release control of the terminal back to the user as it currently does.\r\n\r\nHowever, this might be a somewhat substantial feature to implement and support, so I would really appreciate some input on it before proceeding.\r\n\r\nI imagine at least one configuration option called something like `session_refresh_frequency` that says how often to refresh the session.\r\n\r\n## AWS CLI Plugin API\r\n\r\nAlternatively, I thought about building a plugin for AWS CLI that somehow detects that the session has timed out, and calls back to `onelogin-aws-cli` to reauthenticate.\r\n\r\nHowever, [the plugin API for AWS CLI is not official at all yet](https://github.com/aws/aws-cli/issues/2350). Also, I imagine that the plugin API might not allow me to hook into and control the execution of any other arbitrary command.\r\n\r\nSo as far as I can see, an AWS CLI plugin is not looking like a realistic option at this point.\r\n"},"comment":{"url":"https://api.github.com/repos/physera/onelogin-aws-cli/issues/comments/400714600","html_url":"https://github.com/physera/onelogin-aws-cli/issues/119#issuecomment-400714600","issue_url":"https://api.github.com/repos/physera/onelogin-aws-cli/issues/119","id":400714600,"node_id":"MDEyOklzc3VlQ29tbWVudDQwMDcxNDYwMA==","user":{"login":"thnee","id":51159,"node_id":"MDQ6VXNlcjUxMTU5","avatar_url":"https://avatars1.githubusercontent.com/u/51159?v=4","gravatar_id":"","url":"https://api.github.com/users/thnee","html_url":"https://github.com/thnee","followers_url":"https://api.github.com/users/thnee/followers","following_url":"https://api.github.com/users/thnee/following{/other_user}","gists_url":"https://api.github.com/users/thnee/gists{/gist_id}","starred_url":"https://api.github.com/users/thnee/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/thnee/subscriptions","organizations_url":"https://api.github.com/users/thnee/orgs","repos_url":"https://api.github.com/users/thnee/repos","events_url":"https://api.github.com/users/thnee/events{/privacy}","received_events_url":"https://api.github.com/users/thnee/received_events","type":"User","site_admin":false},"created_at":"2018-06-27T15:23:47Z","updated_at":"2018-06-27T15:23:47Z","author_association":"CONTRIBUTOR","body":"Thank you very much for the input! And sorry for keeping this open for so long.\r\n\r\n@slycoder You're right, simply re-authenticating over and over would not be compliant. We must detect whether the session is actually idle or being used.\r\n\r\nAgree, it wont be reliable to determine idleness from onelogin-aws-cli.\r\n\r\nThe only reliable way that I can see would be to make a plugin for aws cli that hooks into all sub commands and registers that something has been executed. (Possibly keeping track of which account/role is being used). Unfortunately I have not been able to find a way to do that while browsing the aws cli source code.\r\n\r\n@drewsonne Thank you very much for the pointers, but I don't think that `_emit_session_event()` is enough. The big issue is that I would need to hook into all sub commands to know if anything has been called or not."}}
{"actor":{"display_login":"thnee"}}