Function assumeRole

packages/components/src/awsToolsUtils.ts:141–203

* Assume an IAM role using AWS STS and return temporary session credentials. * * This is an internal helper called by getAWSCredentialConfig when a `roleArn` * is present. It creates an STS client with the provided base credentials (or the SDK * default credential chain if none are suppl

(params: {
    accessKeyId?: string
    secretAccessKey?: string
    sessionToken?: string
    roleArn: string
    externalId?: string
    region: string
    logger?: any
})

 * @throws {Error} When the STS API call fails — The full error is logged server-side.
 */
async function assumeRole(params: {
    accessKeyId?: string
    secretAccessKey?: string
    sessionToken?: string
    roleArn: string
    externalId?: string
    region: string
    logger?: any
}): Promise<AWSCredentials> {
    const { accessKeyId, secretAccessKey, sessionToken, roleArn, externalId, region, logger } = params

    // Build STS client config
    const stsConfig: STSClientConfig = { region }

    // Use explicit credentials if provided; otherwise SDK default chain
    if (accessKeyId && secretAccessKey) {
        stsConfig.credentials = {
            accessKeyId,
            secretAccessKey,
            ...(sessionToken && { sessionToken })
        }
    }

    const stsClient = new STSClient(stsConfig)

    const assumeRoleInput: AssumeRoleCommandInput = {
        RoleArn: roleArn,
        RoleSessionName: `FlowiseSession-${Date.now()}`
    }

    if (externalId) {
        assumeRoleInput.ExternalId = externalId
    }

    try {
        const response = await stsClient.send(new AssumeRoleCommand(assumeRoleInput))

        if (!response.Credentials?.AccessKeyId || !response.Credentials?.SecretAccessKey || !response.Credentials?.SessionToken) {
            throw new Error('STS AssumeRole returned incomplete credentials')
        }

        return {
            accessKeyId: response.Credentials.AccessKeyId,
            secretAccessKey: response.Credentials.SecretAccessKey,
            sessionToken: response.Credentials.SessionToken
        }
    } catch (error) {
        if (error instanceof Error && error.message === 'STS AssumeRole returned incomplete credentials') {
            throw error
        }
        const rawMessage = error instanceof Error ? error.message : String(error)
        // Log full error server-side for operator debugging (includes IAM principal ARNs, account IDs, etc.)
        if (logger) {
            logger.error(`[AWS STS] AssumeRole failed for role "${roleArn}": ${rawMessage}`)
        }
        // Return sanitized error to user — no raw STS message that may contain internal infrastructure details
        throw new Error(
            'Failed to assume IAM role. ' +