diff --git a/local-app/python-tools/gfl-resource-actions/aws_utils.py b/local-app/python-tools/gfl-resource-actions/aws_utils.py index f1b6d899..2ffdead0 100644 --- a/local-app/python-tools/gfl-resource-actions/aws_utils.py +++ b/local-app/python-tools/gfl-resource-actions/aws_utils.py @@ -41,25 +41,50 @@ def get_available_regions(): except Exception as e: logger.error(f"Error getting available regions: {e}") # Return a default list of common regions as fallback - return ['us-east-1', 'us-east-2', 'us-west-1', 'us-west-2'] + return ['us-gov-east-1', 'us-gov-west-1'] -def assume_role(account_id): +def get_partition_for_region(region): + """ + Determine the AWS partition for a given region. + + Args: + region (str): AWS region name + + Returns: + str: AWS partition name ('aws', 'aws-us-gov', 'aws-cn') + """ + if region.startswith('us-gov-'): + return 'aws-us-gov' + elif region.startswith('cn-'): + return 'aws-cn' + else: + return 'aws' + +def assume_role(account_id, region=None): """ Assume the OrganizationAccountAccessRole in the specified account. Args: account_id (str): AWS account ID to assume role in + region (str, optional): AWS region, used to determine partition Returns: dict: Credentials dictionary or None if failed """ try: - role_arn = f"arn:aws:iam::{account_id}:role/{config.ASSUME_ROLE_NAME}" - sts_client = boto3.client('sts') + # Use default region from config if not provided + if region is None: + region = config.DEFAULT_REGION + + # Determine the correct partition for the ARN + partition = get_partition_for_region(region) + + role_arn = f"arn:{partition}:iam::{account_id}:role/{config.ASSUME_ROLE_NAME}" + sts_client = boto3.client('sts', region_name=region) response = sts_client.assume_role( RoleArn=role_arn, - RoleSessionName="ResourceManagementSession" + RoleSessionName="Gliffy" ) return response['Credentials'] diff --git a/local-app/python-tools/gfl-resource-actions/config.py b/local-app/python-tools/gfl-resource-actions/config.py index 060abc19..53f6a5ae 100644 --- a/local-app/python-tools/gfl-resource-actions/config.py +++ b/local-app/python-tools/gfl-resource-actions/config.py @@ -3,7 +3,7 @@ """ # Role name to assume in member accounts -ASSUME_ROLE_NAME = "OrganizationAccountAccessRole" +ASSUME_ROLE_NAME = "r-inf-terraform" # Default node group sizes for EKS when starting DEFAULT_NG_MIN_SIZE = 1