Positive Exit Codes

[verehfy]

Hi there,

A possible enhancement to consider. We use the tool as part of some scripts to simplify running Terraform commands. It would be nice if the saml2aws-auto refresh <group-name> returned a positive exit code if the refresh fails to correctly refresh all roles. This, in turn, would force our scripts to exit rather than continue with invalid AWS tokens.

Hopefully that makes sense. Any additional information I can provide, just let me know.

[Rukenshia]

I'm not 100% sure about this - generally the only "failure" scenario for me would be:

• Invalid Keycloak credentials or configuration
• Invalid MFA
• Non-existing group refreshed

Accounts in groups are built to be more tolerant of failures, which is also why the tool ignores failures during the refresh and outputs an error message with it, but I can also see your use case.

I am not sure how I would communicate which group failed to refresh using just exit codes, or is this a case where as soon as any account in the group is not refreshed, you would want to stop running your script?

The easiest method I see would not involve saml2aws-auto and rather run

aws sts get-caller-identity --profile <profile-name>

in your script (and exit on error). That way you can still run your automation/script for all profiles that do have valid credentials and skip the ones which don't.