From a30c0f135cd7f0fc5de39353dd07bc17dabee248 Mon Sep 17 00:00:00 2001
From: Rohan Patnaik <rohanpatnaik1997@gmail.com>
Date: Fri, 22 May 2026 14:10:09 +0530
Subject: [PATCH] feat(credentials): support web identity duration seconds

---
 botocore/credentials.py        |  7 +++++++
 tests/unit/test_credentials.py | 30 ++++++++++++++++++++++++++++++
 2 files changed, 37 insertions(+)

diff --git a/botocore/credentials.py b/botocore/credentials.py
index 571dfeac6a..246822c902 100644
--- a/botocore/credentials.py
+++ b/botocore/credentials.py
@@ -1957,6 +1957,13 @@ def _assume_role_with_web_identity(self):
         if role_session_name is not None:
             extra_args['RoleSessionName'] = role_session_name
 
+        duration_seconds = self._get_profile_config('duration_seconds')
+        if duration_seconds is not None:
+            try:
+                extra_args['DurationSeconds'] = int(duration_seconds)
+            except ValueError:
+                pass
+
         fetcher = AssumeRoleWithWebIdentityCredentialFetcher(
             client_creator=self._client_creator,
             web_identity_token_loader=token_loader,
diff --git a/tests/unit/test_credentials.py b/tests/unit/test_credentials.py
index 1fc4474f7f..4ec88127cf 100644
--- a/tests/unit/test_credentials.py
+++ b/tests/unit/test_credentials.py
@@ -1131,6 +1131,36 @@ def test_role_session_name_provided(self):
             WebIdentityToken='totally.a.token',
         )
 
+    def test_duration_seconds_provided(self):
+        self.config['duration_seconds'] = '7200'
+        response = {
+            'Credentials': {
+                'AccessKeyId': 'foo',
+                'SecretAccessKey': 'bar',
+                'SessionToken': 'baz',
+                'Expiration': self.some_future_time().isoformat(),
+            },
+        }
+        client_creator = self.create_client_creator(with_response=response)
+        mock_loader_cls = self._mock_loader_cls('totally.a.token')
+        provider = credentials.AssumeRoleWithWebIdentityProvider(
+            load_config=self._load_config,
+            client_creator=client_creator,
+            cache={},
+            profile_name=self.profile_name,
+            token_loader_cls=mock_loader_cls,
+        )
+
+        provider.load().get_frozen_credentials()
+
+        client = client_creator.return_value
+        client.assume_role_with_web_identity.assert_called_with(
+            RoleArn='arn:aws:iam::123:role/role-name',
+            DurationSeconds=7200,
+            RoleSessionName=mock.ANY,
+            WebIdentityToken='totally.a.token',
+        )
+
     def test_role_arn_not_set(self):
         del self.config['role_arn']
         client_creator = self.create_client_creator(with_response={})