This release brings a few minor bug fixes and support for Just-In-Time (JIT) access using Common Fate. For more information on JIT access, check out the JIT recipe in our documentation. A big thankyou to @Nepoxx for making their first contribution in this release!

What's Changed

• Cleanup profile registry implementation + improve testability by @chrnorm in https://github.com/common-fate/granted/pull/622
• fix bug where every line is removed in config by @Nepoxx in https://github.com/common-fate/granted/pull/631
• Update just-in-time access integration by @chrnorm in https://github.com/common-fate/granted/pull/630
• cleanup the large banners and replace them with a single-line version by @chrnorm in https://github.com/common-fate/granted/pull/633
• add a check for empty access key ID when caching by @chrnorm in https://github.com/common-fate/granted/pull/632

New Contributors

• @Nepoxx made their first contribution in https://github.com/common-fate/granted/pull/631

Full Changelog: https://github.com/common-fate/granted/compare/v0.22.0...v0.23.0

IAM Federated logins now have attributable username in Cloudtrail

• The changes refactor the way federation token ID is used for AWS IAM credentials. Instead of relying on the userID which was previously parsed, the code now uses the userName which is more easily attributable to the IAM user name in the Cloudtrail events list view.

What's Changed

• fix runtime error when sso token expires by @shwethaumashanker in https://github.com/common-fate/granted/pull/627
• Bump google.golang.org/protobuf from 1.31.0 to 1.33.0 by @dependabot in https://github.com/common-fate/granted/pull/621
• feat: Use aws:username for IAM initiated federated console sessions. by @matthewhembree in https://github.com/common-fate/granted/pull/626

New Contributors

• @matthewhembree made their first contribution in https://github.com/common-fate/granted/pull/626

Full Changelog: https://github.com/common-fate/granted/compare/v0.21.1...v0.22.0

What's Changed

• Revert breaking change to 'granted login' with additional prompt for SSO scopes by @chrnorm in https://github.com/common-fate/granted/pull/618
• Add --so-scope in hint for granted sso login by @keymon in https://github.com/common-fate/granted/pull/619

New Contributors

• @keymon made their first contribution in https://github.com/common-fate/granted/pull/619

Full Changelog: https://github.com/common-fate/granted/compare/v0.21.0...v0.21.1

Added support for refreshable AWS SSO

You can now add granted_sso_registration_scopes = sso:account:access to your ~/.aws/config, which will cause Granted to respect the session duration in IAM Identity Center. This can be extended to prompt less frequently. Supplying thesso:account:access scope will cause IAM Identity Center to return a refreshable access token, with a total allowed session time in accordance with your configured AWS SSO session length.

What's Changed

• Adds event bridge service map by @CodyDunlap in https://github.com/common-fate/granted/pull/611
• Delete former credentials when rotating (granted credentials rotate) by @n3s7or in https://github.com/common-fate/granted/pull/582
• Bump github.com/dvsekhvalnov/jose2go from 1.5.0 to 1.6.0 by @dependabot in https://github.com/common-fate/granted/pull/586
• Add support for refreshable AWS SSO tokens by @chrnorm in https://github.com/common-fate/granted/pull/616

New Contributors

• @CodyDunlap made their first contribution in https://github.com/common-fate/granted/pull/611

Full Changelog: https://github.com/common-fate/granted/compare/v0.20.7...v0.21.0

Added better error handling for oauth2 invalid_grant error

we have added better error handling for the oauth2 invalid_grant error. Now, whenever this error is encountered, Granted automatically clears the cached token and sends a message like:

[i] It looks like the above error was caused by an invalid authentication token. We have cleared the token from your keychain. To re-run the command, you'll need to authenticate again by running: 'granted login https://d3h0e9z8klkkkk.cloudfront.net/'

What's Changed

• Improve oauth2 error handling for Glide authentication by @shwethaumashanker in https://github.com/common-fate/granted/pull/596
• Update service_map.go to add codeartifact, codesuite and codecommit by @wayne-folkes in https://github.com/common-fate/granted/pull/594

Full Changelog: https://github.com/common-fate/granted/compare/v0.20.6...v0.20.7

Fix for assume --exec with multiple arguments/spaces

The output from goassume when --exec is provided now returns the arguments with proper escaping/splitting to ensure they are evaluated when passed to sh -c in the assume script.

What's Changed

• Fix export lookup values when exporting credentials by @cedieio in https://github.com/common-fate/granted/pull/578
• fix: assume --exec with multiple arguments/spaces by @lyoung-confluent in https://github.com/common-fate/granted/pull/584
• Fix backwards invocation of io.Copy by @sosheskaz in https://github.com/common-fate/granted/pull/589
• Create ~/.aws/config if it does not exist by @sosheskaz in https://github.com/common-fate/granted/pull/590

Full Changelog: https://github.com/common-fate/granted/compare/v0.20.5...v0.20.6

What's Changed

• Fix SSO_START_URL lookup for credential exports by @cedieio in https://github.com/common-fate/granted/pull/572
• Revert "Ensure proper initialization of profiles with source_profile" by @JoshuaWilkes in https://github.com/common-fate/granted/pull/576

Full Changelog: https://github.com/common-fate/granted/compare/v0.20.4...v0.20.5

Added TTY support for --exec

--exec now uses the shell script to execute commands instead of Go; this enables TTY applications to work as expected.

ExportSSOToken Configuration and --export-sso-token Flag

@cedieio has introduced the --export-sso-token flag, which exports the SSO token to ~/.aws/sso/cache. The ExportSSOToken configuration automatically exports the SSO token by default.

Change in EKS set up

The command field in your ~/.kube/config needs to be changed to assume from assumego. Follow docs here

What's Changed

• Allow access token to be exported to plain text on ~/.aws/sso/cache by @cedieio in https://github.com/common-fate/granted/pull/518
• fix(fish_alias): fix assume script path for fish alias for brew by @Mallear in https://github.com/common-fate/granted/pull/561
• support exec using shell script for TTY applications by @JoshuaWilkes in https://github.com/common-fate/granted/pull/549
• Ensure proper initialization of profiles with source_profile by @XargsUK in https://github.com/common-fate/granted/pull/559
• Do not overwrite AWS config when sync fails by @sosheskaz in https://github.com/common-fate/granted/pull/569
• 🐛 Fix SSO token lookup keys by @cedieio in https://github.com/common-fate/granted/pull/565
• 🔧 Add ExportSSOToken config by @cedieio in https://github.com/common-fate/granted/pull/566

New Contributors

• @cedieio made their first contribution in https://github.com/common-fate/granted/pull/518
• @Mallear made their first contribution in https://github.com/common-fate/granted/pull/561
• @XargsUK made their first contribution in https://github.com/common-fate/granted/pull/559

Full Changelog: https://github.com/common-fate/granted/compare/v0.20.3...v0.20.4

Generate JSON output for SSO token expiry

Run granted sso-tokens expiry --json to print the SSO token expiry in JSON. Additionally, you can use jq to filter and display only the expired tokens in JSON format: granted sso-tokens expiry --json | jq -r '[.[] | select(.is_expired == true)]'

What's Changed

• add aos (Amazon OpenSearch) to ServiceMap by @eserte in https://github.com/common-fate/granted/pull/552
• fix(firefox_dev): fix granted containers for Firefox Dev Edition by @paulhobbel in https://github.com/common-fate/granted/pull/553
• Fix for IAM in secure storage + MFA issue by @shwethaumashanker in https://github.com/common-fate/granted/pull/557
• Output-sso-expiry-in-JSON by @shwethaumashanker in https://github.com/common-fate/granted/pull/550

New Contributors

• @eserte made their first contribution in https://github.com/common-fate/granted/pull/552
• @paulhobbel made their first contribution in https://github.com/common-fate/granted/pull/553

Full Changelog: https://github.com/common-fate/granted/compare/v0.20.2...v0.20.3

What's Changed

Downgrades aws config package and dependency ini due to a performance regression causing large config files to hang

• Update ini vers by @meyerjrr in https://github.com/common-fate/granted/pull/546

Full Changelog: https://github.com/common-fate/granted/compare/v0.20.1...v0.20.2