aws/session: Add support for chaining source_profile with credential_source

[janario]

We have a scenario where our the first access will assume one cross account role and after it assume roles for each operation

We tried with the aws cli and everything works fine, but we have some operations that will use the go-sdk (aws-iam-authenticator)

Our conf will be something like:

[profile CIRole]
region = eu-central-1
role_arn = CIRole
credential_source = Ec2InstanceMetadata
external_id = external_id

[profile EKSRole]
region = eu-central-1
role_arn = EKSRole
source_profile = CIRole

using the aws cli it works as expected

export AWS_PROFILE=EKSRole
aws sts get-caller-identity
{
    "Account": "...", 
    "UserId": "...", 
    "Arn": "...EKSRole/botocore-session-..."
}

But when we trigger the aws-iam-authenticator

export AWS_PROFILE=EKSRole
aws-iam-authenticator token -i my-cluster
could not get token: could not create session: SharedConfigAssumeRoleError: failed to load assume role for .../EKSRole, source profile has no shared credentials

---

This PR makes it possible to chain between multiple profiles and to use the credential_source

[janario]

Hi, Any update here? 🙂

[jasdel]

Hi @janario thanks for the ping, this feature request is in our backlog to review. We'll prioritize reviewing this Pr and get feedback to you.

[jasdel]

I've pushed an update to this PR that refactors the Session's credential logic into its own file, and adds a unit test for chained assume role. This update also adds support for credential_source targeting EC2 and environment variable.

[nauxliu]

@jasdel It seems that the CI test has failed. Is it possible to merge this PR in the near future?

[janario]

Thanks guys

I'm looking forward for the release of it
🙂