Last active
February 12, 2021 22:00
-
-
Save pofallon/f0295efebfa51aed54e34d04ca521574 to your computer and use it in GitHub Desktop.
Leverage AWS SSO credentials via credential_process
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| #! /usr/bin/env bash | |
| CREDS=$(aws sso get-role-credentials --profile $1 \ | |
| --output json \ | |
| --access-token $(jq -r ".accessToken" $(grep -l "accessToken" ~/.aws/sso/cache/*.json)) \ | |
| --account-id $(aws configure get sso_account_id --profile $1) \ | |
| --role-name $(aws configure get sso_role_name --profile $1) | | |
| jq '.roleCredentials | { | |
| Version: 1, | |
| AccessKeyId: .accessKeyId, | |
| SecretAccessKey: .secretAccessKey, | |
| SessionToken: .sessionToken, | |
| Expiration: (.expiration | . / 1000 | todateiso8601) | |
| }') | |
| if [[ -t 1 ]]; then | |
| export AWS_ACCESS_KEY_ID=$(echo $CREDS | jq -r '.AccessKeyId') | |
| export AWS_SECRET_ACCESS_KEY=$(echo $CREDS | jq -r '.SecretAccessKey') | |
| export AWS_SESSION_TOKEN=$(echo $CREDS | jq -r '.SessionToken') | |
| else | |
| echo $CREDS | |
| fi | |
| : ' | |
| WHAT IT DOES: | |
| Find the SSO cache file with an accessToken in it, and retrieve it | |
| Get the account ID for the given SSO profile | |
| Get the role name for the given SSO profile | |
| Pass these to get-role-credentials | |
| Rewrite the output to put them in the format expected by credential_process | |
| If being called interactively, it exports the AWS_* environment variables | |
| If being called via credentials_process, it returns the proper JSON output | |
| USAGE: | |
| Add a [default] entry to your ~/.aws/credentials file: | |
| [default] | |
| credential_process = "/full/path/to/awsso.sh" [sso-profile] | |
| Login with `aws sso login [sso-profile]` | |
| aws commands using the default profile will trigger this script and use [sso-profile] | |
| aws commands that support SSO can be called with --profile [sso-profile] to skip this | |
| WHAT IT DOES NOT DO: | |
| Cache the results -- it will call get-role-credentials every time it needs credentials | |
| ' |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment