Include stack and space labels in OIDC session tags

We’re using Spacelift OIDC so runs can read secrets from AWS Secrets Manager. My options for the trust policy seem to be limited to the sub string and either wildcarding spaces/stacks by a naming convention that would be messy to implement and maintain, or enumerating slugs in the trust policy which is even less desirable.

I’d like to be able to extend the existing Spacelift autoattach:<label> mechanism that we use to attach contexts to stacks through to the AWS policy by including stack and ideally space labels as session tags. I see that you already have a few session tags as an opt-in feature by way of the feature:aws_oidc_session_tagging stack label, but labels aren’t included in what’s sent.

• AWS limits the number of session tags and key length, so extending the opt-in label with options to filter by prefix such as oidc: would be helpful. It would also let us narrow which labels are used for access control.

• Including space labels would be beneficial from a security and maintainability angle, since space labels can be more tightly controlled than stack labels and not having to label every child stack individual would be much easier to maintain. I’d think these should have separate, configurable prefixes so we could distinguish the label scope on the AWS side.

• If there was a way to enable and configure session tagging (filters, prefixes, stacks/spaces/modules enabled, etc…) at the account level would be great. Having to add that feature label to several hundred stacks is cumbersome.

• Modules should support this too using module labels so module tests can access secrets via OIDC when needed.

Using labels in this way doesn’t feel like it adds a new trust boundary since stack labels already can/are used to control context attachments and role assignments. This would just allow us to use that same mechanism for extending access to other backends.