yplatform/bin/aws-get-cli-sts at master · ysoftwareab/yplatform · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
#!/usr/bin/env bash
set -euo pipefail

TMP_AWS_CLI_CACHE=$(mktemp -t yplatform.XXXXXXXXXX)
function on_exit() {
    rm -rf ${TMP_AWS_CLI_CACHE}
}
trap on_exit EXIT

YP_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." >/dev/null && pwd)"
source ${YP_DIR}/sh/common.inc.sh

AWS_PROFILE=${AWS_PROFILE:-${AWS_DEFAULT_PROFILE:-}}
[[ -n ${AWS_PROFILE} ]] || exit 0

AWS_CLI_CACHE_FILE=${AWS_CLI_CACHE_FILE:-$1}
if [[ -z "${AWS_CLI_CACHE_FILE:-}" ]]; then
    AWS_PROFILE_ROLE_ARN=$(aws configure get role_arn || true)

    if [[ -z ${AWS_PROFILE_ROLE_ARN} ]]; then
        # profile is a user profile
        aws sts get-session-token > ${TMP_AWS_CLI_CACHE}
        AWS_CLI_CACHE_FILE=${TMP_AWS_CLI_CACHE}
    else
        # profile is a role profile
        STS_ASSUME_ROLE_ARN_PREFIX=${AWS_PROFILE_ROLE_ARN/iam/sts}
        STS_ASSUME_ROLE_ARN_PREFIX=${STS_ASSUME_ROLE_ARN_PREFIX/:role\//:assumed-role\/}

        # AWS_CLI_CACHE_FILE=$(ls ~/.aws/cli/cache/ | grep "^${AWS_PROFILE}--arn_aws_iam__" | head -1 || true)
        # gross assumption, but aws-cli/boto changed to hash-named filenames
        AWS_CLI_CACHE_FILE=
        # shellcheck disable=SC2045
        for f in $(ls -t ~/.aws/cli/cache/); do
            # shellcheck disable=SC2015
            cat ~/.aws/cli/cache/${f} | \
                jq -r ".AssumedRoleUser.Arn" | \
                grep -q "${STS_ASSUME_ROLE_ARN_PREFIX}" && \
                AWS_CLI_CACHE_FILE=~/.aws/cli/cache/${f} && \
                break || \
                    true
        done
        [[ -n ${AWS_CLI_CACHE_FILE} ]] || exit 0
    fi
fi

AWS_CLI_CACHE_FILE_EXPIRATION=$(cat ${AWS_CLI_CACHE_FILE} | jq -r ".Credentials.Expiration")
[[ $(date -d "${AWS_CLI_CACHE_FILE_EXPIRATION}" +%s) -ge $(date +%s) ]] || exit 0

[[ -n ${AWS_SECRET_ACCESS_KEY:-} ]] || \
   AWS_SECRET_ACCESS_KEY=$(cat ${AWS_CLI_CACHE_FILE} | jq -r ".Credentials.SecretAccessKey")
[[ -n ${AWS_ACCESS_KEY_ID:-} ]] || \
  AWS_ACCESS_KEY_ID=$(cat ${AWS_CLI_CACHE_FILE} | jq -r ".Credentials.AccessKeyId")
[[ -n ${AWS_SESSION_TOKEN:-} ]] || \
  AWS_SESSION_TOKEN=$(cat ${AWS_CLI_CACHE_FILE} | jq -r ".Credentials.SessionToken")

echo "export AWS_SECRET_ACCESS_KEY=${AWS_SECRET_ACCESS_KEY}"
echo "export AWS_ACCESS_KEY_ID=${AWS_ACCESS_KEY_ID}"
echo "export AWS_SESSION_TOKEN=${AWS_SESSION_TOKEN}"