fix(assume-role): Handle AWS STS CLI errors

include/assume_role

@@ -28,6 +28,7 @@ assume_role(){
 
     # temporary file where to store credentials
     TEMP_STS_ASSUMED_FILE=$(mktemp -t prowler.sts_assumed-XXXXXX)
+    TEMP_STS_ASSUMED_ERROR=$(mktemp -t prowler.sts_assumed-XXXXXX)
 
     # check if role arn or role name
     if [[ $ROLE_TO_ASSUME == arn:* ]]; then
@@ -59,20 +60,32 @@ assume_role(){
       EXITCODE=1
       exit $EXITCODE
     fi
-
-    # assume role command
-    #$AWSCLI $PROFILE_OPT sts assume-role --role-arn arn:${AWS_PARTITION}:iam::$ACCOUNT_TO_ASSUME:role/$ROLE_TO_ASSUME \
-    #    --role-session-name ProwlerAssessmentSession \
-    #    --duration-seconds $SESSION_DURATION_TO_ASSUME > $TEMP_STS_ASSUMED_FILE
-
-    # if previous command fails exit with the given error from aws-cli
-    # this is likely to be due to session duration limit of 1h in case
-    # of assume role chaining:
-    # "The requested DurationSeconds exceeds the 1 hour session limit
-    # for roles assumed by role chaining."
-    # https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_use.html
-    if [[ $? != 0 ]];then
-        exit 1
+    
+    # Check if external ID has bee provided if so execute with external ID if not ignore
+    if [[ -z $ROLE_EXTERNAL_ID ]]; then
+        # Assume role command
+        if ! $AWSCLI $PROFILE_OPT sts assume-role --role-arn $PROWLER_ROLE \
+            --role-session-name ProwlerAssessmentSession \
+            --region $REGION_FOR_STS \
+            --duration-seconds $SESSION_DURATION_TO_ASSUME > $TEMP_STS_ASSUMED_FILE 2>"${TEMP_STS_ASSUMED_ERROR}"
+        then
+            STS_ERROR="$(cat ${TEMP_STS_ASSUMED_ERROR} | tr '\n' ' ')"
+            textFail "${STS_ERROR}"
+            EXITCODE=1
+            exit $EXITCODE
+        fi
+    else
+        if ! $AWSCLI $PROFILE_OPT sts assume-role --role-arn $PROWLER_ROLE \
+            --role-session-name ProwlerAssessmentSession \
+            --duration-seconds $SESSION_DURATION_TO_ASSUME \
+            --region $REGION_FOR_STS \
+            --external-id $ROLE_EXTERNAL_ID > $TEMP_STS_ASSUMED_FILE 2>"${TEMP_STS_ASSUMED_ERROR}"
+        then
+            STS_ERROR="$(cat ${TEMP_STS_ASSUMED_ERROR} | tr '\n' ' ')"
+            textFail "${STS_ERROR}"
+            EXITCODE=1
+            exit $EXITCODE
+        fi
     fi
 
     # The profile shouldn't be used for CLI
@@ -89,4 +102,5 @@ assume_role(){
 
 cleanSTSAssumeFile() {
     rm -fr "${TEMP_STS_ASSUMED_FILE}"
-}
+    rm -fr "${TEMP_STS_ASSUMED_ERROR}"
+}