Tables for Roles Anywhere Profiles and Trust Anchors #2475

2XXE-SRA · 2025-04-17T20:58:59Z

This PR adds two new tables for the Roles Anywhere service. Specifically, it adds support for enumerating Trust Anchors (aws_rolesanywhere_trust_anchor) and Profiles (aws_rolesanywhere_profile).

Example query results

Results

select 
  arn, 
  inline_policy 
from aws_rolesanywhere_profile

+-------------------------------------------------------------------------------------------+----------------------------------------------------------------+
| arn                                                                                       | role_arns                                                      |
+-------------------------------------------------------------------------------------------+----------------------------------------------------------------+
| arn:aws:rolesanywhere:us-east-1:123456789012:profile/fb3dcdae-b099-49ef-bdaf-69590f64c55d | ["arn:aws:iam::123456789012:role/RoleFoo"]                     |
| arn:aws:rolesanywhere:us-east-1:123456789012:profile/7df9cbb7-36c1-432b-b07d-cf6d83de46ef | ["arn:aws:iam::123456789012:role/RoleBar"]                     |
| arn:aws:rolesanywhere:us-east-1:123456789012:profile/8ca8dcf3-1692-478b-8976-1179e47af2d2 | ["arn:aws:iam::123456789012:role/RoleBaz"]                     |
+-------------------------------------------------------------------------------------------+----------------------------------------------------------------+

select 
  arn, 
  source_type
from aws_rolesanywhere_trust_anchor

+------------------------------------------------------------------------------------------------+--------------------+
| arn                                                                                            | source_type        |
+------------------------------------------------------------------------------------------------+--------------------+
| arn:aws:rolesanywhere:us-east-1:123456789012:trust-anchor/7cb25065-23c9-451f-bd1e-3e6ba321a6af | CERTIFICATE_BUNDLE |
| arn:aws:rolesanywhere:us-east-1:123456789012:trust-anchor/45e48edd-d495-499f-96f2-c9544fe02b64 | CERTIFICATE_BUNDLE |
| arn:aws:rolesanywhere:us-east-1:123456789012:trust-anchor/6fbe3a43-df3d-4fbe-a8e8-723bdb430ca7 | CERTIFICATE_BUNDLE |
+------------------------------------------------------------------------------------------------+--------------------+

misraved · 2025-04-17T21:23:06Z

@2XXE-SRA thank you so much for the new tables 🎉 !!

Could you please fix the lint failure?

Copilot

Pull Request Overview

This PR adds support for AWS Roles Anywhere by introducing two new Steampipe tables: one for Trust Anchors and one for Profiles. Key changes include the addition of documentation, table definition implementations, and integration into the plugin service.

Reviewed Changes

Copilot reviewed 7 out of 8 changed files in this pull request and generated no comments.

Show a summary per file

File	Description
docs/tables/aws_rolesanywhere_trust_anchor.md	Added documentation outlining the trust anchor table usage.
docs/tables/aws_rolesanywhere_profile.md	Added documentation outlining the profile table usage.
aws/table_aws_rolesanywhere_trust_anchor.go	Implemented table definition and query functions for trust anchors.
aws/table_aws_rolesanywhere_profile.go	Implemented table definition and query functions for profiles.
aws/service.go	Added RolesAnywhereClient to support new Roles Anywhere APIs.
aws/plugin.go	Registered the new Roles Anywhere tables with the plugin.

Files not reviewed (1)

go.mod: Language not supported

ParthaI · 2025-04-18T05:23:44Z

Hello @2XXE-SRA, great to see the PR with the new table addition!

Just a quick note:

This PR includes an update to the AWS SDK v2, upgrading it to version v1.36.3.
However, this version introduces breaking changes related to ResolverEndpointV2. Which need some efforts to make the changes across the tables.
Would it be possible to downgrade or retain the existing SDK version v1.27.0 instead?
From what I’ve seen, the github.com/aws/aws-sdk-go-v2/service/rolesanywhere package (version v1.11.4) should still be compatible with github.com/aws/aws-sdk-go-v2 version v1.27.0.
- Running the command go get github.com/aws/[email protected] might help you do that.

Thanks!

2XXE-SRA · 2025-04-18T13:24:14Z

Hello @2XXE-SRA, great to see the PR with the new table addition!

Just a quick note:

* This PR includes an update to the AWS SDK v2, upgrading it to version `v1.36.3`.

* However, this version introduces breaking changes related to `ResolverEndpointV2`. Which need some efforts to make the changes across the tables.

* Would it be possible to **downgrade or retain the existing SDK version `v1.27.0`** instead?

* From what I’ve seen, the `github.com/aws/aws-sdk-go-v2/service/rolesanywhere` package (version `v1.11.4`) should still be compatible with `github.com/aws/aws-sdk-go-v2` version `v1.27.0`.
  
  * Running the command `go get github.com/aws/[email protected]` might help you do that.

Thanks!

Yeah, no problem. I think it was just an auto-upgrade when I grabbed the service package. I will test on the lower version and then update the PR.

2XXE-SRA · 2025-04-18T13:47:19Z

Looks like the did the trick!

Copilot

Pull Request Overview

This PR introduces two new Steampipe table implementations for AWS Roles Anywhere by adding support for querying Trust Anchors and Profiles. Key changes include the addition of documentation files for both tables, implementation of the corresponding table definitions and list/get functions in Go, and registration of these new tables via AWS clients in the plugin.

Reviewed Changes

Copilot reviewed 7 out of 8 changed files in this pull request and generated no comments.

Show a summary per file

File	Description
docs/tables/aws_rolesanywhere_trust_anchor.md	Adds documentation for the aws_rolesanywhere_trust_anchor table
docs/tables/aws_rolesanywhere_profile.md	Adds documentation for the aws_rolesanywhere_profile table
aws/table_aws_rolesanywhere_trust_anchor.go	Implements table definition and list/get functions for Trust Anchors
aws/table_aws_rolesanywhere_profile.go	Implements table definition and list/get functions for Profiles
aws/service.go	Adds a new AWS client creation function (RolesAnywhereClient)
aws/plugin.go	Registers the new Roles Anywhere tables in the plugin

Files not reviewed (1)

go.mod: Language not supported

Comments suppressed due to low confidence (2)

aws/table_aws_rolesanywhere_profile.go:121

[nitpick] Consider using Go naming conventions (e.g., profileID) instead of snake_case for variable names.

profile_id := d.EqualsQuals["id"].GetStringValue()

aws/table_aws_rolesanywhere_profile.go:114

Ensure that the transform functions 'unescape' and 'policyToCanonical' are properly defined and imported, as their absence may lead to runtime errors.

Transform:   transform.FromField("SessionPolicy").Transform(unescape).Transform(policyToCanonical),

ParthaI

Hello @2XXE-SRA,

I’ve left a few review comments for you to take a look at.

Additionally, here are some suggestions:

Name the table columns to match the API response, with the exception of the arn column.
Include the standard Steampipe columns.
Update the column descriptions based on the AWS documentation for the API.
Organize the function ordering as follows:
- List Hydrate function
- Get Hydrate function
- Any other Hydrate functions
- Transform functions
It would be great to include more example queries in the table documentation.

Please note: I haven't added any comments for the table aws_rolesanywhere_trust_anchor, but the suggestions above is also applicable for this table.

Thanks!

ParthaI · 2025-04-23T06:26:59Z

aws/table_aws_rolesanywhere_profile.go

+			Hydrate: listProfiles,
+			Tags:    map[string]string{"service": "rolesanywhere", "action": "ListProfiles"},
+		},
+		GetMatrixItemFunc: SupportedRegionMatrix(rolesanywherev1.EndpointsID),


Suggested change

GetMatrixItemFunc: SupportedRegionMatrix(rolesanywherev1.EndpointsID),

GetMatrixItemFunc: SupportedRegionMatrix(AWS_ROLESANYWHERE_SERVICE_ID),

We are halfway through removing support for AWS SDK V1 from the plugin, as the V1 SDK has reached its End of Life.
We have listed all the AWS-supported service IDs in the following file: endpoint_service_ids_gen.go.

ParthaI · 2025-04-23T06:31:30Z

aws/table_aws_rolesanywhere_profile.go

+		GetMatrixItemFunc: SupportedRegionMatrix(rolesanywherev1.EndpointsID),
+		Columns: awsRegionalColumns([]*plugin.Column{
+			{
+				Name:        "id",


Could you please rename the column to profile_id? The table schema should exactly match the API response, except for the arn column.

ParthaI · 2025-04-23T06:36:05Z

aws/table_aws_rolesanywhere_profile.go

+			},
+			{
+				Name:        "accept_role_session_name",
+				Description: "Accept custom role session names.",


Could you please update the column descriptions to align with the API response descriptions? You can refer to the details here: API_ProfileDetail.

Kindly update the descriptions for the remaining columns as well.

ParthaI · 2025-04-23T06:38:27Z

aws/table_aws_rolesanywhere_profile.go

+				Type:        proto.ColumnType_STRING,
+			},
+			{
+				Name:        "duration",


Suggested change

Name: "duration",

Name: "duration_seconds",

ParthaI · 2025-04-23T06:40:21Z

aws/table_aws_rolesanywhere_profile.go

+				Description: "Contains the session policy in a canonical form for easier searching.",
+				Type:        proto.ColumnType_JSON,
+				Transform:   transform.FromField("SessionPolicy").Transform(unescape).Transform(policyToCanonical),
+			},


Please include the steampipe standard column here. For reference: aws_acm_certificate

ParthaI · 2025-04-23T06:41:14Z

aws/table_aws_rolesanywhere_profile.go

+			if d.RowsRemaining(ctx) == 0 {
+				return nil, nil
+			}


Suggested change

if d.RowsRemaining(ctx) == 0 {

return nil, nil

}

// Context may get cancelled due to manual cancellation or if the limit has been reached

if d.RowsRemaining(ctx) == 0 {

return nil, nil

}

2XXE-SRA · 2025-04-23T13:58:30Z

Thanks for the review! I will address these in the next day or two and get back to you.

…comments

2XXE-SRA · 2025-04-23T17:55:48Z

I have pushed changes to both tables per your above suggestions. Please let me know if there are any other required changes.

ParthaI

Hi @2XXE-SRA,

The changes look great! However, I left a few minor review comments—could you please take another look?

I noticed that a couple of columns were missed based on the API response. For example, the name column is missing from the aws_rolesanywhere_trust_anchor table.

Could you please cross-verify if any columns are missing according to the API response?

Note: Please validate both the GET and List API calls response and add the missing columns.

Thanks!

ParthaI · 2025-04-24T07:04:14Z

aws/table_aws_rolesanywhere_profile.go

+				Type:        proto.ColumnType_JSON,
+			},
+			{
+				Name:        "require_instance_properties",


Please move the column upwards as it is a non-JSON column.

ParthaI · 2025-04-24T07:04:44Z

aws/table_aws_rolesanywhere_profile.go

+				Name:        "title",
+				Description: resourceInterfaceDescription("title"),
+				Type:        proto.ColumnType_STRING,
+				Transform:   transform.FromField("ProfileId"),


Suggested change

Transform: transform.FromField("ProfileId"),

Transform: transform.FromField("Name"),

ParthaI · 2025-04-24T07:05:39Z

aws/table_aws_rolesanywhere_profile.go

+				Name:        "akas",
+				Description: resourceInterfaceDescription("akas"),
+				Type:        proto.ColumnType_JSON,
+				Transform:   transform.FromField("ProfileArn").Transform(arnToAkas),


Suggested change

Transform: transform.FromField("ProfileArn").Transform(arnToAkas),

Transform: transform.FromField("ProfileArn").Transform(transform.EnsureStringArray),

ParthaI · 2025-04-24T07:06:52Z

aws/table_aws_rolesanywhere_trust_anchor.go

+				Name:        "akas",
+				Description: resourceInterfaceDescription("akas"),
+				Type:        proto.ColumnType_JSON,
+				Transform:   transform.FromField("TrustAnchorArn").Transform(arnToAkas),


Suggested change

Transform: transform.FromField("TrustAnchorArn").Transform(arnToAkas),

Transform: transform.FromField("TrustAnchorArn").Transform(transform.EnsureStringArray),

ParthaI · 2025-04-24T07:08:03Z

aws/table_aws_rolesanywhere_trust_anchor.go

+				Name:        "title",
+				Description: resourceInterfaceDescription("title"),
+				Type:        proto.ColumnType_STRING,
+				Transform:   transform.FromField("TrustAnchorId"),


Suggested change

Transform: transform.FromField("TrustAnchorId"),

Transform: transform.FromField("Name"),

2XXE-SRA · 2025-04-24T13:39:36Z

Above items addressed!

Could you please cross-verify if any columns are missing according to the API response?

Looks like it was just the name column.

tables for roles anywhere profiles and anchors

b020e00

misraved requested a review from ParthaI April 17, 2025 21:22

misraved assigned 2XXE-SRA Apr 17, 2025

misraved requested a review from Copilot April 17, 2025 21:23

Copilot AI reviewed Apr 17, 2025

View reviewed changes

revert sdk ver change

66505e6

cbruno10 requested a review from Copilot April 21, 2025 13:34

Copilot AI reviewed Apr 21, 2025

View reviewed changes

ParthaI reviewed Apr 23, 2025

View reviewed changes

rolesanywhere profile and trust anchor table updates per turbot#2475 …

05e2be1

…comments

ParthaI reviewed Apr 24, 2025

View reviewed changes

columns value/order cleanup per turbot#2475

d3dc603

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Tables for Roles Anywhere Profiles and Trust Anchors #2475

Tables for Roles Anywhere Profiles and Trust Anchors #2475

2XXE-SRA commented Apr 17, 2025

misraved commented Apr 17, 2025

Copilot AI left a comment

ParthaI commented Apr 18, 2025

2XXE-SRA commented Apr 18, 2025

2XXE-SRA commented Apr 18, 2025

Copilot AI left a comment

ParthaI left a comment

ParthaI Apr 23, 2025

ParthaI Apr 23, 2025

ParthaI Apr 23, 2025

ParthaI Apr 23, 2025

ParthaI Apr 23, 2025

ParthaI Apr 23, 2025

2XXE-SRA commented Apr 23, 2025

2XXE-SRA commented Apr 23, 2025

ParthaI left a comment

ParthaI Apr 24, 2025

ParthaI Apr 24, 2025

ParthaI Apr 24, 2025

ParthaI Apr 24, 2025

ParthaI Apr 24, 2025

2XXE-SRA commented Apr 24, 2025

	GetMatrixItemFunc: SupportedRegionMatrix(rolesanywherev1.EndpointsID),
	GetMatrixItemFunc: SupportedRegionMatrix(AWS_ROLESANYWHERE_SERVICE_ID),

	Transform: transform.FromField("ProfileId"),
	Transform: transform.FromField("Name"),

	Transform: transform.FromField("ProfileArn").Transform(arnToAkas),
	Transform: transform.FromField("ProfileArn").Transform(transform.EnsureStringArray),

	Transform: transform.FromField("TrustAnchorArn").Transform(arnToAkas),
	Transform: transform.FromField("TrustAnchorArn").Transform(transform.EnsureStringArray),

Tables for Roles Anywhere Profiles and Trust Anchors #2475

Are you sure you want to change the base?

Tables for Roles Anywhere Profiles and Trust Anchors #2475

Conversation

2XXE-SRA commented Apr 17, 2025

Example query results

misraved commented Apr 17, 2025

Copilot AI left a comment

Choose a reason for hiding this comment

Pull Request Overview

Reviewed Changes

ParthaI commented Apr 18, 2025

2XXE-SRA commented Apr 18, 2025

2XXE-SRA commented Apr 18, 2025

Copilot AI left a comment

Choose a reason for hiding this comment

Pull Request Overview

Reviewed Changes

ParthaI left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

2XXE-SRA commented Apr 23, 2025

2XXE-SRA commented Apr 23, 2025

ParthaI left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

2XXE-SRA commented Apr 24, 2025