claude-aws-mfa 1.2.2 → 1.3.0

package/CHANGELOG.md

@@ -22,6 +22,11 @@ Releases are automated via CI. To create a new release:
 Stable versions (e.g. `v1.2.0`) publish to npm `@latest`. Pre-release versions
 (e.g. `v1.2.0-rc.1`) publish to npm `@next` and create a GitHub pre-release.
 
+## [v1.3.0] - 2026-10-14
+
+### Added
+- Configurable STS session name in the credentials dialog (defaults to `claude-aws-mfa`).
+
 ## [v1.2.2] - 2026-10-09
 
 ### Changed

package/README.md

@@ -47,7 +47,7 @@ Add this (plus any addtitional config you prefer) to your Claude Code settings (
 ## How it works
 
 1. On first run, seeds the dialog with credentials from your existing AWS config (`~/.aws/credentials`, environment variables, SSO, etc.)
-2. Shows a native GUI dialog with fields for region, access key, secret key, MFA ARN, role ARN, and session duration
+2. Shows a native GUI dialog with fields for region, access key, secret key, MFA ARN, role ARN, session duration, and STS session name (defaults to `claude-aws-mfa`)
 3. Collects the MFA token — either type a 6-digit code directly, or switch to **MFA Command** mode and provide a shell command that outputs the code (e.g. `op item get --otp …` for 1Password CLI)
 4. Calls `sts:AssumeRole` with the MFA token
 5. If the requested session duration is rejected, automatically retries with shorter durations (12h → 6h → 2h → 1h)

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "claude-aws-mfa",
-  "version": "1.2.2",
+  "version": "1.3.0",
   "type": "module",
   "repository": "https://github.com/aaronmeriwether/claude-aws-mfa",
   "bin": {

package/src/config.ts

@@ -28,6 +28,7 @@ export interface Config {
   mfaArn: string;
   roleArn: string;
   duration: number;
+  sessionName?: string;
   mfaMode?: "code" | "command";
   mfaCommand?: string;
   cacheSession?: boolean;

package/src/dialog-html.ts

@@ -1,8 +1,8 @@
-import { STANDARD_DURATIONS } from "./sts";
+import { DEFAULT_SESSION_NAME, STANDARD_DURATIONS } from "./sts";
 import { AUTOSIZE_CSS, AUTOSIZE_SCRIPT } from "./autosize-html";
 import { DEFAULT_PROFILE, type ActiveProfile } from "./config";
 
-export const FIELDS = ["region", "accessKeyId", "secretAccessKey", "mfaArn", "roleArn", "duration", "mfaMode", "mfaCode", "mfaCommand"] as const;
+export const FIELDS = ["region", "accessKeyId", "secretAccessKey", "mfaArn", "roleArn", "duration", "sessionName", "mfaMode", "mfaCode", "mfaCommand"] as const;
 
 export const FIELD_PATTERNS: Record<string, string> = {
   region: "^[a-z]{2}(-[a-z]+-\\d+)$",
@@ -11,6 +11,8 @@ export const FIELD_PATTERNS: Record<string, string> = {
   mfaArn: "^arn:aws:iam::\\d{12}:mfa/.+$",
   roleArn: "^arn:aws:iam::\\d{12}:role/.+$",
   duration: "^[1-9]\\d*$",
+  // AWS RoleSessionName constraint.
+  sessionName: "^[\\w+=,.@-]{2,64}$",
   mfaCode: "^\\d{6}$",
   mfaCommand: "^.+$",
 };
@@ -90,6 +92,7 @@ ${PROFILE_STYLE}
   <div class="field"><label>MFA Device ARN</label><input id="mfaArn" placeholder="arn:aws:iam::123456789012:mfa/user"></div>
   <div class="field"><label>Role ARN</label><input id="roleArn" placeholder="arn:aws:iam::123456789012:role/MyRole"></div>
   <div class="field"><label>Session Duration (seconds)</label><input id="duration" placeholder="${STANDARD_DURATIONS[0]}"></div>
+  <div class="field"><label>Session Name</label><input id="sessionName" placeholder="${DEFAULT_SESSION_NAME}"></div>
   <hr>
   <div class="radio-field">
     <input type="radio" name="mfaMode" id="mfaModeCode" value="code" checked>

package/src/dialog.ts

@@ -3,6 +3,7 @@ import { lib } from "webview-bun/src/ffi";
 import { activeProfile, type Config } from "./config";
 import { buildHtml, buildErrorHtml } from "./dialog-html";
 import { START_HEIGHT, bindAutosize } from "./autosize";
+import { DEFAULT_SESSION_NAME } from "./sts";
 import { version } from "../package.json";
 
 const DIALOG_WIDTH = 440;
@@ -24,6 +25,7 @@ export interface DialogResult {
   mfaArn: string;
   roleArn: string;
   duration: string;
+  sessionName: string;
   mfaMode: "code" | "command";
   mfaCode: string;
   mfaCommand: string;
@@ -81,6 +83,7 @@ export function showDialog(defaults: Partial<Config>): DialogResult | null {
     mfaArn: defaults.mfaArn ?? "",
     roleArn: defaults.roleArn ?? "",
     duration: defaults.duration != null ? String(defaults.duration) : "",
+    sessionName: defaults.sessionName ?? DEFAULT_SESSION_NAME,
     mfaCommand: defaults.mfaCommand ?? "",
     mfaMode: defaults.mfaMode ?? "code",
   }, activeProfile()));

package/src/index.ts

@@ -92,6 +92,7 @@ async function tryAutoMfa(cfg: Partial<Config>): Promise<CachedSession | null> {
     roleArn: cfg.roleArn,
     mfaCode,
     duration: cfg.duration ?? STANDARD_DURATIONS[0],
+    sessionName: cfg.sessionName,
   });
 
   const session: CachedSession = {
@@ -108,6 +109,7 @@ async function tryAutoMfa(cfg: Partial<Config>): Promise<CachedSession | null> {
     mfaArn: cfg.mfaArn,
     roleArn: cfg.roleArn,
     duration,
+    sessionName: cfg.sessionName,
     mfaMode: cfg.mfaMode,
     mfaCommand: cfg.mfaCommand,
     cacheSession: cfg.cacheSession,
@@ -146,6 +148,7 @@ async function obtainViaDialog(cfg: Partial<Config>): Promise<void> {
     roleArn: result.roleArn,
     mfaCode,
     duration: parseInt(result.duration, 10) || STANDARD_DURATIONS[0],
+    sessionName: result.sessionName,
   });
 
   const session: CachedSession = {
@@ -162,6 +165,7 @@ async function obtainViaDialog(cfg: Partial<Config>): Promise<void> {
     mfaArn: result.mfaArn,
     roleArn: result.roleArn,
     duration,
+    sessionName: result.sessionName || undefined,
     mfaMode: result.mfaMode,
     mfaCommand: result.mfaCommand || undefined,
     cacheSession: defaults.cacheSession,

package/src/sts.ts

@@ -1,5 +1,7 @@
 import { STSClient, AssumeRoleCommand } from "@aws-sdk/client-sts";
 
+export const DEFAULT_SESSION_NAME = "claude-aws-mfa";
+
 export const STANDARD_DURATIONS = [129600, 86400, 43200, 28800, 21600, 14400, 7200, 3600];
 
 export function isDurationError(err: unknown): boolean {
@@ -25,6 +27,7 @@ export async function assumeRoleWithMfa(params: {
   roleArn: string;
   mfaCode: string;
   duration: number;
+  sessionName?: string;
 }) {
   const client = new STSClient({
     region: params.region,
@@ -37,7 +40,7 @@ export async function assumeRoleWithMfa(params: {
     try {
       const { Credentials: c } = await client.send(new AssumeRoleCommand({
         RoleArn: params.roleArn,
-        RoleSessionName: "claude-aws-mfa",
+        RoleSessionName: params.sessionName || DEFAULT_SESSION_NAME,
         SerialNumber: params.mfaArn,
         TokenCode: params.mfaCode,
         DurationSeconds: ladder[i],

package/test/dialog-html.test.ts

@@ -103,7 +103,7 @@ describe("buildHtml", () => {
   test("FIELDS list matches expected form fields", () => {
     expect(FIELDS).toEqual([
       "region", "accessKeyId", "secretAccessKey",
-      "mfaArn", "roleArn", "duration", "mfaMode", "mfaCode", "mfaCommand",
+      "mfaArn", "roleArn", "duration", "sessionName", "mfaMode", "mfaCode", "mfaCommand",
     ]);
   });
 
@@ -128,6 +128,7 @@ describe("buildHtml", () => {
       mfaArn: "arn:aws:iam::123456789012:mfa/user",
       roleArn: "arn:aws:iam::123456789012:role/TestRole",
       duration: "43200",
+      sessionName: "claude-aws-mfa",
       mfaCode: "123456",
       mfaCommand: "op item get --otp myitem",
     };
@@ -138,6 +139,7 @@ describe("buildHtml", () => {
       mfaArn: "not-an-arn",
       roleArn: "not-an-arn",
       duration: "abc",
+      sessionName: "has spaces",
       mfaCode: "12",
       mfaCommand: "",
     };

package/test/sts.test.ts

@@ -117,6 +117,12 @@ describe("assumeRoleWithMfa", () => {
     });
   });
 
+  test("passes a custom session name to STS", async () => {
+    await assumeRoleWithMfa({ ...BASE_PARAMS, sessionName: "alice-laptop" });
+
+    expect(capturedCommands[0].RoleSessionName).toBe("alice-laptop");
+  });
+
   test("falls back to shorter duration on duration error", async () => {
     let callCount = 0;
     mockSend = mock(() => {