handleAssumeRoleError provides context-specific error messages for role assumption failures.
(err error, roleArn string, externalID string)
| 96 | |
| 97 | // handleAssumeRoleError provides context-specific error messages for role assumption failures. |
| 98 | func handleAssumeRoleError(err error, roleArn string, externalID string) error { |
| 99 | errStr := err.Error() |
| 100 | |
| 101 | switch { |
| 102 | case strings.Contains(errStr, "AccessDenied"): |
| 103 | if externalID != "" { |
| 104 | return errors.Errorf("failed to assume role %s: access denied (external ID configured: %s)", roleArn, externalID) |
| 105 | } |
| 106 | return errors.Errorf("failed to assume role %s: access denied", roleArn) |
| 107 | |
| 108 | case strings.Contains(errStr, "InvalidParameterValue") && strings.Contains(errStr, "ExternalId"): |
| 109 | return errors.Errorf("failed to assume role %s: external ID mismatch", roleArn) |
| 110 | |
| 111 | case strings.Contains(errStr, "NoSuchEntity") || strings.Contains(errStr, "not found"): |
| 112 | return errors.Errorf("failed to assume role %s: role not found", roleArn) |
| 113 | |
| 114 | case strings.Contains(errStr, "ExpiredToken") || strings.Contains(errStr, "TokenRefreshRequired"): |
| 115 | return errors.Errorf("failed to assume role %s: base AWS credentials expired", roleArn) |
| 116 | |
| 117 | case strings.Contains(errStr, "throttling") || strings.Contains(errStr, "TooManyRequests"): |
| 118 | return errors.Errorf("failed to assume role %s: AWS API rate limit exceeded", roleArn) |
| 119 | |
| 120 | default: |
| 121 | return errors.Wrapf(err, "failed to assume role %s", roleArn) |
| 122 | } |
| 123 | } |
no test coverage detected