sst 2.3.3 → 2.3.4

package/cli/commands/bind.js

@@ -158,18 +158,34 @@ export const bind = (program) => program
         const { Logger } = await import("../../logger.js");
         const { useAWSClient } = await import("../../credentials.js");
         const sts = useAWSClient(STSClient);
-        try {
+        const assumeRole = async (duration) => {
             const { Credentials: credentials } = await sts.send(new AssumeRoleCommand({
                 RoleArn: roleArn,
                 RoleSessionName: "dev-session",
-                DurationSeconds: 43200,
+                DurationSeconds: duration,
             }));
             return credentials;
+        };
+        // Assue role with max duration first. This can fail if chaining roles, or if
+        // the role has a max duration set. If it fails, assume role with 1 hour duration.
+        let err;
+        try {
+            return await assumeRole(43200);
         }
         catch (e) {
-            Colors.line(Colors.warning(`Failed to assume SSR role ${roleArn}. Falling back to using local IAM credentials.`));
-            Logger.debug(`Failed to assume ${roleArn}.`, e);
+            err = e;
+        }
+        if (err.name === "ValidationError" &&
+            err.message.startsWith("The requested DurationSeconds exceeds")) {
+            try {
+                return await assumeRole(3600);
+            }
+            catch (e) {
+                err = e;
+            }
         }
+        Colors.line(Colors.warning(`Failed to assume SSR role ${roleArn}. Falling back to using local IAM credentials.`));
+        Logger.debug(`Failed to assume ${roleArn}.`, err);
     }
     async function localIamCredentials() {
         const { useAWSCredentials } = await import("../../credentials.js");

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "sst",
-  "version": "2.3.3",
+  "version": "2.3.4",
   "bin": {
     "sst": "cli/sst.js"
   },

package/sst.mjs

@@ -7255,23 +7255,35 @@ var bind = (program2) => program2.command(
       const { Logger: Logger2 } = await Promise.resolve().then(() => (init_logger(), logger_exports));
       const { useAWSClient: useAWSClient2 } = await Promise.resolve().then(() => (init_credentials(), credentials_exports));
       const sts = useAWSClient2(STSClient2);
-      try {
+      const assumeRole = async (duration) => {
         const { Credentials: credentials } = await sts.send(
           new AssumeRoleCommand({
             RoleArn: roleArn,
             RoleSessionName: "dev-session",
-            DurationSeconds: 43200
+            DurationSeconds: duration
           })
         );
         return credentials;
+      };
+      let err;
+      try {
+        return await assumeRole(43200);
       } catch (e) {
-        Colors2.line(
-          Colors2.warning(
-            `Failed to assume SSR role ${roleArn}. Falling back to using local IAM credentials.`
-          )
-        );
-        Logger2.debug(`Failed to assume ${roleArn}.`, e);
+        err = e;
+      }
+      if (err.name === "ValidationError" && err.message.startsWith("The requested DurationSeconds exceeds")) {
+        try {
+          return await assumeRole(3600);
+        } catch (e) {
+          err = e;
+        }
       }
+      Colors2.line(
+        Colors2.warning(
+          `Failed to assume SSR role ${roleArn}. Falling back to using local IAM credentials.`
+        )
+      );
+      Logger2.debug(`Failed to assume ${roleArn}.`, err);
     }
     async function localIamCredentials() {
       const { useAWSCredentials: useAWSCredentials3 } = await Promise.resolve().then(() => (init_credentials(), credentials_exports));