Skip to content

docs: record measured AWS vs Azure session revocation behaviour #74

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
aaearon merged 2 commits into from
Aug 23, 2026
Merged

docs: record measured AWS vs Azure session revocation behaviour #74

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
8ec402b
docs: prepare CHANGELOG for v0.10.0 release
aaearon Aug 17, 2026
a78cc64
docs: record measured AWS vs Azure session revocation behaviour
aaearon Aug 23, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 2 additions & 0 deletions CHANGELOG.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4,6 +4,8 @@ All notable changes to this project will be documented in this file.

## [Unreleased]

## [0.10.0] - 2026-08-17

### Changed

- An invalid `cache_ttl` (unparseable, zero or negative) now fails the command instead of silently defaulting; the error names the config file, the expected duration syntax and `--refresh`
Expand Down
2 changes: 2 additions & 0 deletions CLAUDE.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -48,6 +48,8 @@ Custom `SCAAccessService` follows SDK conventions:
- **Exit policy (deliberate, not blanket "fail closed"):** exit 0 when every requested session was accepted, which *includes* `in_progress` — a documented async success state, so failing on it would make legitimate revocations look broken. Exit 1 on `not_applicable`, unrecognized statuses and missing rows. So exit 0 does not prove access is gone; only that nothing was refused or unaccounted for. State it that precisely in docs — `ClassifyRevocationStatus` fails closed, the *command* does not fail on in-progress
- `outcome` (`revoked`/`in_progress`/`not_applicable`/`unknown`) is the single classification field in the JSON. Do not add derived booleans (`accepted`, `complete`, `revoked`) beside it: two representations of one concept drift apart and disagree. Callers switch on `outcome`
- Never attribute a cause for `REVOCATION_NOT_APPLICABLE` (e.g. an AWS/STS story). Observing the status does not prove the reason, and grant supports Azure/AWS/GCP plus group sessions. Render provider-neutral text and keep the raw token
- **Observed live (2026-08-18, one tenant):** AWS sessions return `REVOCATION_NOT_APPLICABLE` and stay active — `sts:GetCallerIdentity` still succeeds after the revoke. Azure roles and Entra groups return `REVOCATION_IN_PROGRESS` and disappear within ~25s. Cause: AWS exposes no session-scoped revocation primitive (STS tokens cannot be invalidated, and `aws:TokenIssueTime` deny / permission removal are role-scoped, so they would hit every concurrent session on that role). Azure/Entra elevations are role assignments, which are individually removable. **So `grant revoke` cannot contain leaked AWS credentials** — use the IAM console's Revoke sessions, or wait out expiry
- The provider-neutral rule above still stands for *user-facing text*: this note records what was measured, it is not licence to print an AWS story at runtime
- `GET /api/access/{CSP}/eligibility/groups` — list eligible Entra ID groups (response: `groupId`/`groupName`/`directoryId`)
- `POST /api/access/elevate/groups` — request group membership elevation (response wrapped in `response` key, same as cloud elevation)
- **Headers:** `Authorization: Bearer {jwt}`, `X-API-Version: 2.0`, `Content-Type: application/json`
Expand Down
Loading