Giter Club home page Giter Club logo

assume-aws-role's Introduction

assume-aws-role

Work with multiple AWS accounts more easily.

If you currently manage multiple AWS accounts and use role switching to do work in them, this is the tool for you!

Requirements

Usage

First, you need to install the tool from NPM:

npm install -g assume-aws-role

Next, you need to add a role that you'd like to assume. As an example, lets say I wanted to add the Administrator role for my sandbox account with MFA required:

assume-aws-role add sandbox \
  "arn:aws:iam::123456789012:role/Administrator" \
  "arn:aws:iam::109876543210:mfa/jbuck"

Now you can assume that role we just added:

assume-aws-role sandbox 123456

Now you've got a shell with your temporary security credentials in the environment:

(assume-aws-role sandbox)$

You can also add roles without MFA devices:

assume-aws-role add sandbox \
  "arn:aws:iam::123456789012:role/Administrator"

You can list all the defined roles with a single command:

assume-aws-role list

You can delete a defined alias with a single command:

assume-aws-role delete <alias>

How does it work?

Any roles you add are stored in ~/.assume-aws-role/config. It's optional but highly recommended that you use a MFA device.

assume-aws-role uses the STS:AssumeRole API to assume the role you specified.

After receiving valid credentials assume-aws-role will spawn the shell specified in $SHELL with the environment modified to include AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY, and AWS_SESSION_TOKEN. The environment also includes an overridden PS1 with a minimal custom prompt, and ASSUME_AWS_ROLE with the role so you can fully customize the PS1 prompt by yourself.

assume-aws-role's People

Contributors

fpavageau avatar jbuck avatar mostlygeek avatar nbrys avatar pablochacin avatar

Stargazers

avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar

Watchers

avatar avatar avatar

Forkers

dsolsona fpavageau shortjared patouche pierreliddle vandrewskis pablochacin nbrys

assume-aws-role's Issues

unset cli

Very nice. Thank you.

A cmd to clear set env vars would be nice. I sometimes go back and forth with an assumed role and with sourcing a bash script but have to manually clear the token.

Add option to list all accounts

Now, I need to remember all the aliases I defined or open the config file. Add an option to list all the defined aliases.

For example:
assume-aws-role list

corrupted large config file

Hello, I had a list of 36 profiles - added by hand - but there must have been a syntax issue:

$ assume-aws-role list                               
/home/tom/.nvm/versions/node/v7.2.0/lib/node_modules/assume-aws-role/bin/assume-aws-role.js:70                        
        var aliases = Object.keys(config);                                                                            
                             ^                                                                                        
                                                                                                                      
TypeError: Cannot convert undefined or null to object                                                                 
    at Function.keys (<anonymous>)                                                                                    
    at Object.<anonymous> (/home/tom/.nvm/versions/node/v7.2.0/lib/node_modules/assume-aws-role/bin/assume-aws-role.js:70:23)                                                                                                               
    at Module._compile (module.js:571:32)                                                                             
    at Object.Module._extensions..js (module.js:580:10)                                                               
    at Module.load (module.js:488:32)                                                                                 
    at tryModuleLoad (module.js:447:12)                                                                               
    at Function.Module._load (module.js:439:3)                                                                        
    at Module.runMain (module.js:605:10)                                                                              
    at run (bootstrap_node.js:420:7)                                                                                  
    at startup (bootstrap_node.js:139:9)

After which assume-aws-role wiped my file.

 cat ~/.assume-aws-role/config                           
Error: source does not appear to be markup.

If it is user error, why doesn't the config file have a json extension? Need a graceful exit that does not change the file if it can not be read.

aws/config

Any interest in using aws/config type file to unify with the aws cli?

Support for DurationSeconds

The default duration seconds is 3600 seconds, and sometimes, it's not long enough for developers to do jobs and they have to assume the same role again. It would be very convenient if the DurationSeconds parameter is supported.

Adding first role fails without config file

This error is thrown:

fs.js:584
  return binding.open(pathModule._makeLong(path), stringToFlags(flags), mode);
                 ^

Error: ENOENT: no such file or directory, open '/Users/{user}/.assume-aws-role/config'
    at Error (native)
    at Object.fs.openSync (fs.js:584:18)
    at Object.fs.readFileSync (fs.js:431:33)
    at Object.readFileSync (/usr/local/lib/node_modules/assume-aws-role/node_modules/jsonfile/index.js:31:20)
    at Object.<anonymous> (/usr/local/lib/node_modules/assume-aws-role/bin/assume-aws-role.js:40:19)
    at Module._compile (module.js:398:26)
    at Object.Module._extensions..js (module.js:405:10)
    at Module.load (module.js:344:32)
    at Function.Module._load (module.js:301:12)
    at Function.Module.runMain (module.js:430:10)

Return the return code from shell

When using the assume-aws-role command as part of a script, it would be convenient to receive the return code from the shell spawn instead of always returning 0.

Example:
echo "aws s3 sync ... " | assume-aws-role myrole

will always return 0, even if the aws s3 command fails.

MFA token not optional

Despite the readme (It's optional but highly recommended that you use a MFA device.), it appears this cannot be used without MFA tokens.

Recommend Projects

  • React photo React

    A declarative, efficient, and flexible JavaScript library for building user interfaces.

  • Vue.js photo Vue.js

    🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.

  • Typescript photo Typescript

    TypeScript is a superset of JavaScript that compiles to clean JavaScript output.

  • TensorFlow photo TensorFlow

    An Open Source Machine Learning Framework for Everyone

  • Django photo Django

    The Web framework for perfectionists with deadlines.

  • D3 photo D3

    Bring data to life with SVG, Canvas and HTML. 📊📈🎉

Recommend Topics

  • javascript

    JavaScript (JS) is a lightweight interpreted programming language with first-class functions.

  • web

    Some thing interesting about web. New door for the world.

  • server

    A server is a program made to process requests and deliver data to clients.

  • Machine learning

    Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.

  • Game

    Some thing interesting about game, make everyone happy.

Recommend Org

  • Facebook photo Facebook

    We are working to build community through open source technology. NB: members must have two-factor auth.

  • Microsoft photo Microsoft

    Open source projects and samples from Microsoft.

  • Google photo Google

    Google ❤️ Open Source for everyone.

  • D3 photo D3

    Data-Driven Documents codes.