aws-iam auth backend: Renew-self fails when bound_iam_principal_arn is a role with a path

[flosell]

tl;dr:
When validating renew-self requests for a token from the aws-iam auth backend, vault seems to compare the canonicalArn (which is stripped of the path) against whatever was configured as bound_iam_principal_arn (which might contain the path). This seems to be at least unintuitive.

Expected Behavior:
renew-self works when a complete ARN with a path (e.g. arn:aws:iam::account-id:role/something/some-role) was configured as bound_iam_principal_arn

Actual Behavior:

URL: PUT https://vaulthost:8200/v1/auth/token/renew-self
Code: 500. Errors:

* 1 error occurred:
* failed to renew entry: role no longer bound to arn "arn:aws:iam::account-id:role/some-role"

Steps to Reproduce:

• enable the AWS IAM Auth Backend
• create an AWS IAM Role that contains a path (e.g. something/some-role)
• configure a mapping from this role to a policy in vault, use the ARN including the path (arn:aws:iam::account-id:role/something/some-role), e.g.

{
   "auth_type":"iam",
   "resolve_aws_unique_ids":true,
   "bound_iam_principal_arn": "arn:aws:iam::account-id:role/something/some-role",
   "policies": "some-policy",
   "max_ttl": "5m"
}

• authenticate with vault using the role mentioned above
• call renew-self
• observe the error described above
• change mapping by removing the path from the arn: "bound_iam_principal_arn": "arn:aws:iam::account-id:role/some-role",
• authenticate and renew-self again, observe that all works fine.

Vault Version
Vault 0.7.3 in official Docker container

References

• This might be the line where it goes wrong: https://github.com/hashicorp/vault/blob/master/builtin/credential/aws/path_login.go#L968-L970

Workaround
Remove the path from the bound_iam_principal_arn.

[jefferai]

I believe this was fixed somewhere in the 0.8.x series, can you try 0.8.3?

[flosell]

The only issue that looked related to me was #2781 that I felt dealt with a slightly different problem.

I'll see if I can find a way to reproduce the issue on 0.8.3

[flosell]

Looks like this was indeed fixed in 0.8.0, sorry for the noise!

Just out of curiosity, is #3012 the fix we are talking about?

In case anyone's interested, here is the a script to reproduce the bug and the fix: https://gist.github.com/flosell/f744110ab30bd16f679f8c7254c22d11

[joelthompson]

Yes, I believe that's the fix for your issue.