[Feature request] Support for custom Session Tags and Session Name

[taraspos]

Feature request

Ability to configure Custom Session Tags and Custom Session Names for STS sessions created by EKS Pod Identities.

Context

Currently it's not possible to configure neither Custom Session Tags¹ nor Custom Session Name².

This makes it impossible to implement certain use-cases where I need to configure IAM policies based on custom IDs, rather than supported values of:

• eks-cluster-arn
• eks-cluster-name
• kubernetes-namespace
• kubernetes-service-account
• kubernetes-pod-name
• kubernetes-pod-uid

Also, existing session tags consume more than a half of STS packedPolicySize, would be great to be able to optionally disable some tags, to reduce policy size:

• [EKS][eks-pod-identity]: EKS Pod Identity STS packedPolicySize is too large when chaining roles containers-roadmap#2413

Footnotes

1. https://docs.aws.amazon.com/eks/latest/userguide/pod-id-abac.html#pod-id-abac-custom-tags ↩

2. https://github.com/aws/containers-roadmap/issues/2362 ↩

[taer]

This also helps with MSK's IAM policy. The MSK server gets angry and de-auths you when your session name changes. So your MSK connection is alive and well for the initial X hours. When pod-identtity-agent assumes a NEW STS role when the old expires, the session name changes, which causes MSK to kick you out. The error you get is about principals changing. The fix is to set AWS_ROLE_SESSION_NAME, which isn't possible w/ pod-identity

aws/aws-msk-iam-auth#104

[taer]

linking to aws roadmap in case it helps aws/containers-roadmap#2362