diff --git a/README.md b/README.md index e81c1e7..859e86c 100644 --- a/README.md +++ b/README.md @@ -23,12 +23,47 @@ The MFA code is the code your MFA device gives you. At a command prompt run the following command. ```bash -mfa +mfa ``` +Or you can just run "mfa" and it will use the default profile and a default time duration. +For usage execute "mfa -h". + ### Alias Note Scripts run in a subprocess of the calling shell. This means that if you attempt to set the env vars in the script, they will only persist inside that subprocess. The `alias.sh` script sets an alias function to source the env vars into your main shell whenever you run the `mfa` command. + +### Assume role helper + +Also added a assume_role script that works very similar as mfa script, uses roles.cfg for the assuming any roles. + +To use this with MFA make sure your policies have the following: + +```bash +"Condition": { + "Bool": { + "aws:MultiFactorAuthPresent": "true" + } +} +``` +For further reference: https://docs.aws.amazon.com/STS/latest/APIReference/API_AssumeRole.html + +### Assume Role Usage: + +Copy `SAMPLE-roles.cfg` to `~/roles.cfg` + +Assume role using assume_role script. + +```bash +assume_role +``` + +### Clear Creds +There is also an script to clear the environment credentials. This is helpful if you are moving from one role to another without having to wait for the duration of the token to expire. + +```bash +clear_creds +``` diff --git a/SAMPLE-roles.cfg b/SAMPLE-roles.cfg new file mode 100644 index 0000000..147b76a --- /dev/null +++ b/SAMPLE-roles.cfg @@ -0,0 +1,2 @@ +role1="arn:aws:iam::12345:role/myFirstRole" +role2="arn:aws:iam::23456:role/mySecondRole" diff --git a/alias.sh b/alias.sh index 6e21940..f8e3213 100755 --- a/alias.sh +++ b/alias.sh @@ -4,4 +4,16 @@ setToken() { source ~/.token_file echo "Your creds have been set in your env." } +AssumeRole() { + ~/assume_role.sh $1 + source ~/.token_file + echo "Your creds have been set in your env." +} +clearToken() { + ~/mfa-clear.sh + source ~/.token_file + echo "Your creds have been cleared." +} alias mfa=setToken +alias clear_creds=clearToken +alias assume_role=AssumeRole diff --git a/assume_role.sh b/assume_role.sh new file mode 100755 index 0000000..ec4dfe8 --- /dev/null +++ b/assume_role.sh @@ -0,0 +1,49 @@ +#!/bin/bash +# set -x +# +# Once the temp token is obtained, you'll need to feed the following environment +# variables to the aws-cli: +# +# export AWS_ACCESS_KEY_ID='KEY' +# export AWS_SECRET_ACCESS_KEY='SECRET' +# export AWS_SESSION_TOKEN='TOKEN' + +AWS_CLI=`which aws` + +if [ $? -ne 0 ]; then + echo "AWS CLI is not installed; exiting" + exit 1 +else + echo "Using AWS CLI found at $AWS_CLI" +fi + +if [ -z ~/.token_file ] +then + source ~/..token_file +fi + +# 1 argument is ok +if [[ $# -ne 1 ]]; then + echo "Usage: $0 " + echo "Where:" + echo " = aws role in $HOME/roles.cfg" + exit 2 +fi + +echo "Reading config..." +if [ ! -r ~/roles.cfg ]; then + echo "No config found. Please create your mfa.cfg. See README.txt for more info." + exit 2 +fi + +AWS_CLI_ROLE=${1:-default} +DURATION=${2:-129600} +ARN_OF_ROLE=$(grep "^$AWS_CLI_ROLE" ~/roles.cfg | cut -d '=' -f2- | tr -d '"') + +echo "AWS-CLI ROLE: $AWS_CLI_ROLE" +echo "ROLE ARN: $ARN_OF_ROLE" + +echo "Your Temporary Creds:" +aws sts assume-role --role-arn $ARN_OF_ROLE \ + --role-session-name $AWS_CLI_ROLE --query "Credentials" --output text \ + | awk '{printf("export AWS_ACCESS_KEY_ID=\"%s\"\nexport AWS_SECRET_ACCESS_KEY=\"%s\"\nexport AWS_SESSION_TOKEN=\"%s\"\nexport AWS_SECURITY_TOKEN=\"%s\"\n",$1,$3,$4,$4)}' | tee ~/.token_file diff --git a/mfa-clear.sh b/mfa-clear.sh new file mode 100755 index 0000000..f8a1843 --- /dev/null +++ b/mfa-clear.sh @@ -0,0 +1,7 @@ +#!/bin/bash +# set -x +# Use unset to clear env vars + +echo "unset AWS_ACCESS_KEY_ID +unset AWS_SECRET_ACCESS_KEY +unset export AWS_SESSION_TOKEN" > ~/.token_file diff --git a/mfa.sh b/mfa.sh index 299f9b4..b3c9024 100755 --- a/mfa.sh +++ b/mfa.sh @@ -1,4 +1,5 @@ #!/bin/bash +# set -x # # Sample for getting temp session token from AWS STS # @@ -21,14 +22,17 @@ else echo "Using AWS CLI found at $AWS_CLI" fi -# 1 or 2 args ok -if [[ $# -ne 1 && $# -ne 2 ]]; then - echo "Usage: $0 " - echo "Where:" - echo " = Code from virtual MFA device" - echo " = aws-cli profile usually in $HOME/.aws/config" - exit 2 -fi +# Helper +while getopts ":h" option; do + case $option in + h) # display Help + echo "Usage: $0 " + echo "Where:" + echo " (Optional) = aws-cli profile usually in $HOME/.aws/config" + echo " (Optional) = Token code duration time (default 129600)" + exit;; + esac +done echo "Reading config..." if [ ! -r ~/mfa.cfg ]; then @@ -36,8 +40,10 @@ if [ ! -r ~/mfa.cfg ]; then exit 2 fi -AWS_CLI_PROFILE=${2:-default} -MFA_TOKEN_CODE=$1 +echo -n "Enter your MFA Token: " >&2 +read -s MFA_TOKEN_CODE +AWS_CLI_PROFILE=${1:-default} +DURATION=${2:-129600} ARN_OF_MFA=$(grep "^$AWS_CLI_PROFILE" ~/mfa.cfg | cut -d '=' -f2- | tr -d '"') echo "AWS-CLI Profile: $AWS_CLI_PROFILE" @@ -45,6 +51,6 @@ echo "MFA ARN: $ARN_OF_MFA" echo "MFA Token Code: $MFA_TOKEN_CODE" echo "Your Temporary Creds:" -aws --profile $AWS_CLI_PROFILE sts get-session-token --duration 129600 \ +aws --profile $AWS_CLI_PROFILE sts get-session-token --duration $DURATION \ --serial-number $ARN_OF_MFA --token-code $MFA_TOKEN_CODE --output text \ | awk '{printf("export AWS_ACCESS_KEY_ID=\"%s\"\nexport AWS_SECRET_ACCESS_KEY=\"%s\"\nexport AWS_SESSION_TOKEN=\"%s\"\nexport AWS_SECURITY_TOKEN=\"%s\"\n",$2,$4,$5,$5)}' | tee ~/.token_file