aws-asmr 0.0.4 → 0.0.7

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: b9804add634c49c85745aa41741d6558b7dc5e0cab20426aaa9827eb06ae6808
-  data.tar.gz: 8ebaaabd5a6a65c5609ff08a2723a4fa135298667b842cd7175549dec6069b96
+  metadata.gz: 5f82db6a4f331d524f5c56dab14452abe7e6b727e4870990fec14410eb728cdd
+  data.tar.gz: 62c1380dbe38966db335122e19e285fb1b3c6d0b3ba960c1e9d3023312d689ba
 SHA512:
-  metadata.gz: 0345bb76d7e174c1a18debd29a262d85506cb95f4e2c76c7f4aa86a1ca9bd6de6c09c5a040d12794cae2af1ea18582d311789bf458fb935a1525d0c30dd5ab37
-  data.tar.gz: 4fb26c3b1aeb378ff4da4e47b0bf5450c70223d781f1993c1dbb03353755eb59781d8ba7a61e5798d19e003491cca53d6a3307afd2adff7312e04b52d9374fd4
+  metadata.gz: 5ce7c9d028f0e67023005ff923e663d1fa79ea32229656ace998ce56736251264644ca87e1f61615534097c633927b729a7fbaa2444e2652caaa285651ff8276
+  data.tar.gz: 0dd4c41871053793bece7cd69f82e8776f342137f2f927a07272023a39fd9e6badb13dfee37c2f308fc035ffbc5781b8972b1b1abb8efa2b175ef16272f6fc37

data/README.md

@@ -33,12 +33,14 @@ Of course you can set `AWS_ACCESS_KEY_ID`, `AWS_SECRET_ACCESS_KEY` respectively
 AWS_ACCESS_KEY_ID=xxxx AWS_SECRET_ACCESS_KEY=yyyy asmr --name=arn:aws:iam::0000:role/AwesomeRole aws sts get-caller-identity
 ```
 
-To specify ARN (or alias name of assumed role), you MUST set `name` option with a form like `--name=<arn>` NOT a form like `--name <arn>`. For short version, `-n<arn>` works, `-n <arn>` doesn't. You must be wasting time for this pitfall, sorry!  
-This is due to a development circumstance. This tool is supposed to run 2 commands. One is assume_role, and the other is subsequential(this is main though) command. To safely separate options for assume_role and subsequential commands, all components of the `asmr` args must be start with `-`. Curse my programming ability!
+To specify ARN (or alias name of assumed role), set the `name` option in any of the usual forms. Option parsing stops at the first argument that is not an option (or at a literal `--`), and everything from there on is the subsequential command, including its own options such as `--filter`.
 
 ```
 asmr --name=arn:aws:iam::0000:role/AwesomeRole
+asmr --name arn:aws:iam::0000:role/AwesomeRole
 asmr -narn:aws:iam::0000:role/AwesomeRole
+asmr -n arn:aws:iam::0000:role/AwesomeRole
+asmr -n arn:aws:iam::0000:role/AwesomeRole -- aws sts get-caller-identity
 ```
 
 Of course you can set options for subsequential command.
@@ -47,10 +49,13 @@ Of course you can set options for subsequential command.
 asmr --name=arn:aws:iam::0000:role/AwesomeRole aws ec2 describe-instances --filter '[{"Name":"instance-state-name","Values":["stopped"]}]'
 ```
 
-Unfortunatelly you need quote and appropriate escape to run piped command as subsequential.
+When the subsequential command is given as several arguments, it is executed directly (no shell in between): each argument reaches the command exactly as your shell handed it to `asmr`, so quotes, spaces and `$` in arguments need no extra escaping. Note that your shell still interprets `|`, `&&` and redirects *before* `asmr` runs, so in `asmr aws s3 ls | grep foo` only `aws s3 ls` gets the credentials (which is usually what you want).
+
+To run a whole pipeline as the assumed role, pass it as a single argument; a single argument is run through `sh`, so pipes, redirects and variable expansion work inside it.
 
 ```
 asmr --name=arn:aws:iam::0000:role/AwesomeRole "aws sts get-caller-identity | grep Arn"
+asmr --name=arn:aws:iam::0000:role/AwesomeRole 'echo $AWS_ACCESS_KEY_ID'
 ```
 
 Without subsequential command, it just prints environment variables for assume_role.
@@ -69,6 +74,7 @@ Here is the example of alias file. `arn` is the only required attribute.
 [awesome-app-staging]
 arn = arn:aws:iam::0001:role/AwesomeRole
 profile = custodian
+region = ap-northeast-1
 
 [awesome-app-production]
 arn = arn:aws:iam::0002:role/AwesomeRole
@@ -79,6 +85,8 @@ secret_access_key = yyyy
 # arn = test
 ```
 
+`region` is optional and is only used by `asmr-login` (see below) to pick the console landing region.
+
 Then, you can choose one of the alias.
 
 ```
@@ -91,3 +99,65 @@ Or you can specify alias name.
 ```
 asmr --name=awesome-app-staging aws sts get-caller-identity
 ```
+
+## Pin a role to a directory (`asmr local`)
+
+Following the `rbenv local` convention, you can pin an alias (or a role ARN) to a directory. `asmr local NAME` writes the name to `.asmr` in the current directory; from then on, `asmr` and `asmr-login` run there **without `--name`** assume that role instead of asking you to choose one. The nearest `.asmr` in the current directory or any of its parents wins, so pinning a project root covers its subdirectories.
+
+```
+cd ~/src/awesome-app
+asmr local awesome-app-staging   # writes ./.asmr
+asmr aws sts get-caller-identity # assumes awesome-app-staging, no prompt
+asmr-login                       # opens the console as awesome-app-staging
+```
+
+`asmr local` refuses a name that is neither an alias defined in `~/.aws-asmr/alias` nor a role ARN, the same way rbenv refuses a version that is not installed. A pin whose alias was deleted later fails with a message pointing at the `.asmr` file.
+
+```
+asmr local            # prints the name pinned in the current directory
+asmr local --unset    # removes ./.asmr
+```
+
+`--name` always takes precedence over the pin. Note that pinning is by directory, not by shell: entering a pinned directory silently switches the role, so be careful with production aliases (checking `asmr local` before a destructive command is cheap). Like `.ruby-version`, `.asmr` is yours to commit or ignore.
+
+## Session duration
+
+The lifetime of the temporary credentials (seconds, 900-43200) is set via the alias's optional `session_duration`. It is passed as `DurationSeconds` to `assume_role`, so a longer value means fewer MFA prompts: the cached credentials stay valid until they expire.
+
+```
+[my-awesome-project]
+arn = arn:aws:iam::xxxx:role/AdminRole
+profile = smcdk-prejp
+session_duration = 43200
+```
+
+When omitted, the role's default (1 hour) applies. The value must not exceed the role's *Maximum session duration* in IAM, and it cannot exceed 1 hour when the credentials used to assume the role are themselves temporary (role chaining). When STS rejects it, `asmr` retries without `session_duration` and tells you so, **except** when an MFA code was just consumed: a TOTP code cannot be reused, so `asmr` fails with guidance instead of asking you for another code. A change to `session_duration` only takes effect after the currently cached credentials expire (or after `asmr --clear`).
+
+## Web Login (AWS Management Console)
+
+The companion command `asmr-login` opens the **AWS Management Console** in your browser as the assumed role, using the [AWS federation endpoint](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_providers_enable-console-custom-url.html). This is handy when you want a *browser* session for a role you normally only use from the CLI.
+
+```
+asmr-login --name=awesome-app-staging
+```
+
+It assumes the role exactly like `asmr` does — sharing the same alias resolution (`--name`/`-n`), MFA prompt and credential cache — then exchanges the temporary credentials for a sign-in token at `https://signin.aws.amazon.com/federation` and opens the resulting console URL in your default browser. On a headless host where no browser opener is available, the URL is printed instead (it is valid for 15 minutes — treat it as a secret).
+
+### Landing region
+
+The console page you land on is derived from the `region` of the chosen alias. Add `region` to the alias:
+
+```
+[my-awesome-project]
+arn = arn:aws:iam::xxxx:role/AdminRole
+profile = smcdk-prejp
+region = ap-northeast-1
+```
+
+Then `asmr-login --name=my-awesome-project` opens the console home of `ap-northeast-1`. When the alias has no `region` (or you pass an ARN directly), it falls back to the global console home (`https://console.aws.amazon.com/`).
+
+### Session duration
+
+The console session duration is the alias's `session_duration` described above; it is sent as `SessionDuration` to the federation endpoint as well. When omitted, `asmr-login` requests 43200 (12h).
+
+Note: the requested duration must be **less than the assumed role's maximum session duration** (1 hour by default). When the federation endpoint rejects it (e.g. the role's max is shorter, or you reached the role via role chaining), `asmr-login` automatically retries *without* it, falling back to the lifetime of the temporary credentials. To get a full 12-hour console session, raise the role's *Maximum session duration* in IAM and set `session_duration = 43200`.

data/bin/asmr

@@ -1,89 +1,27 @@
 #!/usr/bin/env ruby
 
-require "aws/asmr"
-require "aws/asmr/options"
-require "aws/asmr/prompt"
-
-asmr_args, command_args = Aws::ASMR::Options.partition(ARGV)
-options = Aws::ASMR::Options.parse(asmr_args)
-
-if options[:version]
-  require "aws/asmr/version"
-  puts Aws::ASMR::VERSION
-  exit(0)
-elsif options[:clear]
-  Aws::ASMR::Cache.destroy!
-  exit(0)
-else
-end
-
-prompt = Aws::ASMR::Prompt.safe
-
-name = if options[:name]
-  options[:name]
-else
-  alias_keys = Aws::ASMR::Alias.base.keys
-  if alias_keys.empty?
-    STDERR.puts "Please specify --name=ARN to assume_role or make alias at #{Aws::ASMR::ROOT}/alias"
-    exit(1)
-  end
-  prompt.select("Choose a role you're going to assume:", alias_keys)
-end
-asmr_alias = Aws::ASMR::Alias.get(name)
-assume_role_arn = if asmr_alias
-  asmr_alias.set_environment_variables!
-  asmr_alias.arn
-else
-  name
-end
-
-def run(command, shell_variables=[])
+require "aws/asmr/cli"
+
+# Runs command with the temporary credentials in its environment. The
+# credentials never go through a shell command line, so they are not visible
+# in `ps` output or shell history of the child.
+#
+#   asmr                                  # no command: print the variables
+#   asmr "aws sts get-caller-identity | grep Arn"
+#       # one argument: a shell command line, so pipes and redirects work
+#   asmr aws ec2 describe-instances --filter '[{"Name":"instance-state-name","Values":["stopped"]}]'
+#       # several arguments: executed directly, each argument passed verbatim
+def run(cache, command)
   if command.empty?
-    exec("echo \"#{shell_variables.join($/)}\"")
+    puts cache.shell_variables
   else
-    command = if command.length == 1
-      # Ex: asmr "aws sts get-caller-identity | grep Arn"
-      command
-    else
-      # Ex: asmr aws ec2 describe-instances --filter '[{"Name":"instance-state-name","Values":["stopped"]}]'
-      command.map{|plain|
-        if plain.match?(/[\"\'\ ]/)
-          quoted = plain.gsub("'"){"\\'"}
-          "'#{quoted}'"
-        else
-          plain
-        end
-      }
-    end
-    exec([*shell_variables, *command].join(' '))
+    exec(cache.environment, *command)
   end
-end 
-
-if cache = Aws::ASMR::Cache.get(assume_role_arn)
-  run(command_args, cache.shell_variables)
+rescue Errno::ENOENT
+  STDERR.puts "asmr: command not found: #{command.first}"
+  exit(127)
 end
 
-
-begin
-  serial_number = Aws::ASMR.detect_mfa_device_serial_number
-  assume_role_args = asmr_alias ? asmr_alias.assume_role_args : {}
-  assume_role_args = if serial_number
-    token_code = prompt.ask("Type MFA token code:")
-    assume_role_args.merge({serial_number: serial_number, token_code: token_code})
-  else
-    assume_role_args
-  end
-
-  res = Aws::ASMR.assume_role(assume_role_arn, **assume_role_args)
-  cache = Aws::ASMR::Cache.new(**res.credentials.to_h)
-  cache.save!(assume_role_arn)
-  run(command_args, cache.shell_variables)
-rescue => e
-  STDERR.puts e.message
-  if options[:verbose]
-    STDERR.puts e.backtrace
-  else
-    STDERR.puts "Add --verbose for more error information."
-  end
-  exit(1)
-end
+Aws::ASMR::CLI.main(ARGV) do |cache, command_args, _options|
+  run(cache, command_args)
+end

data/bin/asmr-login

@@ -0,0 +1,13 @@
+#!/usr/bin/env ruby
+
+require "aws/asmr/cli"
+
+# Session duration is read from the alias only; nil lets WebLogin fall back to
+# its default.
+Aws::ASMR::CLI.main(ARGV) do |cache, _command_args, _options, asmr_alias|
+  args = { region: asmr_alias&.region }
+  duration = asmr_alias&.duration_seconds
+  args[:session_duration] = duration if duration
+  url = Aws::ASMR::WebLogin.signin_url(cache, **args)
+  Aws::ASMR::WebLogin.open_browser(url)
+end

data/lib/aws/asmr/alias.rb

@@ -3,7 +3,7 @@ require 'aws/asmr'
 
 module Aws
   module ASMR
-    class Alias < Struct.new(:arn, :access_key_id, :secret_access_key, :profile, :external_id, :role_session_name, keyword_init: true)
+    class Alias < Struct.new(:arn, :access_key_id, :secret_access_key, :profile, :external_id, :role_session_name, :region, :session_duration, keyword_init: true)
 
       PATH = "#{Aws::ASMR::ROOT}/alias"
 
@@ -58,7 +58,13 @@ module Aws
       end
 
       def assume_role_args
-        {external_id: external_id, role_session_name: role_session_name}.compact
+        {external_id: external_id, role_session_name: role_session_name, duration_seconds: duration_seconds}.compact
+      end
+
+      # session_duration as an Integer, or nil when unset. Used both as
+      # DurationSeconds of assume_role and as SessionDuration of the console.
+      def duration_seconds
+        session_duration.to_i if session_duration && !session_duration.empty?
       end
     end
   end

data/lib/aws/asmr/cache.rb

@@ -52,12 +52,18 @@ module Aws
         end
       end
 
-      def shell_variables
+      # Environment for a process running as the assumed role, ready for
+      # Kernel#exec / Kernel#spawn.
+      def environment
         {
-          AWS_ACCESS_KEY_ID: access_key_id,
-          AWS_SECRET_ACCESS_KEY: secret_access_key,
-          AWS_SESSION_TOKEN: session_token,
-        }.map{|k,v| "#{k}=#{v}"}
+          "AWS_ACCESS_KEY_ID" => access_key_id,
+          "AWS_SECRET_ACCESS_KEY" => secret_access_key,
+          "AWS_SESSION_TOKEN" => session_token,
+        }
+      end
+
+      def shell_variables
+        environment.map{|k,v| "#{k}=#{v}"}
       end
     end
   end

data/lib/aws/asmr/cli.rb

@@ -0,0 +1,119 @@
+require "aws/asmr"
+require "aws/asmr/options"
+require "aws/asmr/prompt"
+
+module Aws
+  module ASMR
+    # The parts shared by every asmr executable: option parsing, --version /
+    # --clear, resolving the role (alias or ARN), and obtaining temporary
+    # credentials via assume_role (with MFA prompt and caching).
+    #
+    # Each executable is just a thin wrapper that decides what to do with the
+    # resolved credentials:
+    #
+    #   Aws::ASMR::CLI.main(ARGV) do |cache, command_args, options, asmr_alias|
+    #     # ... use cache.shell_variables / build a login URL / etc.
+    #   end
+    module CLI
+      # Parses asmr-level args, handles --version/--clear, resolves credentials
+      # and yields (cache, command_args, options, asmr_alias) to the block; the
+      # resolved alias is nil when an ARN was given directly. Top-level errors
+      # are reported here (with a backtrace under --verbose) and exit non-zero.
+      def main(argv)
+        options, command_args = Options.parse(argv)
+        Local.run(command_args.drop(1)) if command_args.first == "local"
+
+        if options[:version]
+          require "aws/asmr/version"
+          puts VERSION
+          exit(0)
+        elsif options[:clear]
+          Cache.destroy!
+          exit(0)
+        end
+
+        prompt = Prompt.safe
+        begin
+          cache, asmr_alias = resolve_credentials(options, prompt)
+          yield cache, command_args, options, asmr_alias
+        rescue => e
+          STDERR.puts e.message
+          if options[:verbose]
+            STDERR.puts e.backtrace
+          else
+            STDERR.puts "Add --verbose for more error information."
+          end
+          exit(1)
+        end
+      end
+
+      # Resolves the role to assume (from --name/-n, the nearest .asmr pin, or an
+      # interactive alias selection) and returns [cache, asmr_alias]: a Cache
+      # holding temporary credentials (reusing a valid cache entry or performing
+      # assume_role with an MFA prompt), and the resolved Alias (nil when an ARN
+      # was given directly).
+      def resolve_credentials(options, prompt)
+        name = options[:name] || pinned_name || begin
+          alias_keys = Alias.base.keys
+          if alias_keys.empty?
+            STDERR.puts "Please specify --name=ARN to assume_role or make alias at #{ROOT}/alias"
+            exit(1)
+          end
+          prompt.select("Choose a role you're going to assume:", alias_keys)
+        end
+
+        asmr_alias = Alias.get(name)
+        assume_role_arn = if asmr_alias
+          asmr_alias.set_environment_variables!
+          asmr_alias.arn
+        else
+          name
+        end
+
+        if cache = Cache.get(assume_role_arn)
+          return [cache, asmr_alias]
+        end
+
+        serial_number = Aws::ASMR.detect_mfa_device_serial_number
+        assume_role_args = asmr_alias ? asmr_alias.assume_role_args : {}
+        if serial_number
+          token_code = prompt.ask("Type MFA token code:")
+          assume_role_args = assume_role_args.merge(serial_number: serial_number, token_code: token_code)
+        end
+
+        res = perform_assume_role(assume_role_arn, assume_role_args, mfa: !serial_number.nil?)
+        cache = Cache.new(**res.credentials.to_h)
+        cache.save!(assume_role_arn)
+        [cache, asmr_alias]
+      end
+
+      # Name pinned by the nearest .asmr (see Local), validated so that a stale
+      # pin fails with a clear message instead of an obscure assume_role error.
+      def pinned_name
+        name, file = Local.find
+        return nil unless name
+        Local.validate!(name, source: file)
+        name
+      end
+
+      # Calls assume_role. When DurationSeconds is rejected (the role's max
+      # session duration is shorter, or the source credentials are temporary so
+      # role chaining caps it at 1h), retries without it -- unless an MFA code
+      # was consumed, since a TOTP code cannot be reused; then it fails with
+      # guidance rather than asking for another code.
+      def perform_assume_role(arn, args, mfa:)
+        Aws::ASMR.assume_role(arn, **args)
+      rescue Aws::STS::Errors::ValidationError => e
+        raise unless args[:duration_seconds] && e.message.match?(/durationseconds/i)
+        hint = "assume_role with DurationSeconds=#{args[:duration_seconds]} was rejected: #{e.message}"
+        if mfa
+          raise "#{hint}\nLower session_duration in the alias (or raise the role's maximum session duration) and try again."
+        end
+        STDERR.puts "#{hint} Retrying without DurationSeconds..."
+        Aws::ASMR.assume_role(arn, **args.reject { |k, _| k == :duration_seconds })
+      end
+
+      module_function :main, :resolve_credentials, :pinned_name, :perform_assume_role
+    end
+  end
+end

data/lib/aws/asmr/local.rb

@@ -0,0 +1,79 @@
+require 'pathname'
+require 'aws/asmr'
+
+module Aws
+  module ASMR
+    # Per-directory pinning of the role to assume, modelled after `rbenv local`.
+    #
+    #   asmr local NAME      # write NAME (alias or ARN) to ./.asmr
+    #   asmr local           # print the name pinned in the current directory
+    #   asmr local --unset   # remove ./.asmr
+    #
+    # When asmr runs without --name, the nearest .asmr found in the current
+    # directory or any of its parents decides the role, so the interactive
+    # alias selection is skipped.
+    module Local
+      FILE_NAME = ".asmr"
+      ARN_PATTERN = %r{\Aarn:aws[\w-]*:iam::\d{12}:role/}
+
+      # Runs the `local` subcommand with its remaining args and exits.
+      def run(args)
+        if args.empty?
+          name = read(Dir.pwd)
+          abort "asmr: no local role configured for this directory" unless name
+          puts name
+        elsif args == ["--unset"]
+          unset(Dir.pwd)
+        elsif args.length == 1 && !args.first.start_with?('-')
+          write(args.first, Dir.pwd)
+        else
+          abort "Usage: asmr local [NAME|--unset]"
+        end
+        exit(0)
+      rescue RuntimeError => e
+        abort e.message
+      end
+
+      def path(dir)
+        File.join(dir, FILE_NAME)
+      end
+
+      # Name pinned exactly in dir (first non-empty, non-comment line), or nil.
+      def read(dir)
+        file = path(dir)
+        return nil unless File.file?(file)
+        File.readlines(file).map(&:strip).find { |l| !l.empty? && !l.start_with?('#') }
+      end
+
+      # Walks up from dir to the filesystem root and returns [name, file] of the
+      # nearest .asmr, or nil when none is found.
+      def find(dir = Dir.pwd)
+        Pathname.new(dir).expand_path.ascend do |d|
+          name = read(d.to_s)
+          return [name, path(d.to_s)] if name
+        end
+        nil
+      end
+
+      def write(name, dir)
+        validate!(name)
+        File.write(path(dir), "#{name}\n")
+      end
+
+      def unset(dir)
+        file = path(dir)
+        File.delete(file) if File.exist?(file)
+      end
+
+      # A name must be a defined alias or a role ARN, the same way rbenv refuses
+      # to pin a version that is not installed.
+      def validate!(name, source: nil)
+        return if Alias.get(name) || name.match?(ARN_PATTERN)
+        where = source ? " (pinned at #{source})" : ""
+        raise "asmr: '#{name}'#{where} is neither an alias defined at #{Alias::PATH} nor a role ARN"
+      end
+
+      module_function :run, :path, :read, :find, :write, :unset, :validate!
+    end
+  end
+end

data/lib/aws/asmr/options.rb

@@ -3,27 +3,24 @@ require "aws/asmr"
 
 module Aws::ASMR
   module Options
-    def partition(args)
-      _idx, asmr_args, command_args = args.reduce([1, [], []]) do |acc,i|
-        idx, _, _ = acc
-        unless i.start_with?('-')
-          idx = 2
-          acc[0] = idx
-        end
-        acc[idx] << i
-        acc
-      end
-      [asmr_args, command_args]
-    end
-
-    def parse(args)
+    # Parses asmr's own options from the head of argv and returns
+    # [options, command_args]. Parsing stops at the first non-option argument
+    # (or after a literal "--"), so anything from there on -- including
+    # arguments like --filter that start with "-" -- belongs to the command:
+    #
+    #   asmr --name=foo aws ec2 describe-instances --filter '...'
+    #   asmr --name foo aws sts get-caller-identity
+    #   asmr -n foo -- aws sts get-caller-identity
+    def parse(argv)
       options = {}
+      command_args = argv.dup
       OptionParser.new do |opts|
         # opts.banner = "Usage: asmr [options]"
         opts.banner = <<~EOS
           You can use ALIAS to shortcut name input by setting it at #{Aws::ASMR::ROOT}/alias
 
-          Usage: asmr [options] [command] [arg...]
+          Usage: asmr [options] [--] [command] [arg...]
+                 asmr local [NAME|--unset]   Pin NAME (alias or ARN) to the current directory
         EOS
 
         opts.on("-nNAME", "--name=NAME", "Name to perform assume role with ARN or ALIAS") do |name|
@@ -42,14 +39,11 @@ module Aws::ASMR
         end
         opts.on("--clear", "Clear cache") do
           options[:clear] = true
-          # require "aws/asmr/version"
-          # puts Aws::ASMR::VERSION
-          # exit(0)
         end
-      end.parse(args)
-      options
+      end.order!(command_args)
+      [options, command_args]
     end
 
-    module_function :partition, :parse
+    module_function :parse
   end
 end

data/lib/aws/asmr/version.rb

@@ -1,5 +1,5 @@
 module Aws
   module ASMR
-    VERSION = "0.0.4"
+    VERSION = "0.0.7"
   end
 end

data/lib/aws/asmr/web_login.rb

@@ -0,0 +1,99 @@
+require 'json'
+require 'uri'
+require 'net/http'
+require 'rbconfig'
+require 'aws/asmr'
+
+module Aws
+  module ASMR
+    # Builds a sign-in URL for the AWS Management Console out of the temporary
+    # credentials obtained by assume_role, using the AWS federation endpoint.
+    # See: https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_providers_enable-console-custom-url.html
+    module WebLogin
+      ENDPOINT = "https://signin.aws.amazon.com/federation"
+      DEFAULT_DESTINATION = "https://console.aws.amazon.com/"
+      DEFAULT_ISSUER = "aws-asmr"
+      # Console session duration. Up to 43200 (12h), but it must be LESS than the
+      # max session duration setting of the role being assumed (default 1h), so
+      # request_signin_token falls back to omitting it when the endpoint rejects it.
+      DEFAULT_SESSION_DURATION = 43200
+
+      # Exchanges the temporary credentials for a sign-in token at the federation
+      # endpoint. Retries without SessionDuration when it is rejected (e.g. the
+      # role's max session duration is shorter, or the credentials come from role
+      # chaining, both of which make SessionDuration invalid).
+      def signin_token(cache, session_duration: DEFAULT_SESSION_DURATION)
+        res = request_signin_token(cache, session_duration)
+        if !res.is_a?(Net::HTTPSuccess) && session_duration
+          STDERR.puts "getSigninToken with SessionDuration=#{session_duration} was rejected (HTTP #{res.code}). Retrying without SessionDuration..."
+          res = request_signin_token(cache, nil)
+        end
+        unless res.is_a?(Net::HTTPSuccess)
+          raise "Federation endpoint returned HTTP #{res.code}: #{res.body}"
+        end
+        token = JSON.parse(res.body)["SigninToken"]
+        raise "Federation endpoint did not return a SigninToken: #{res.body}" unless token
+        token
+      end
+
+      # Builds the final console login URL. Valid for 15 minutes after creation.
+      # The landing page defaults to the given region's console home, or the
+      # global console home when no region is given (e.g. ARN passed directly).
+      def signin_url(cache, region: nil, issuer: DEFAULT_ISSUER, session_duration: DEFAULT_SESSION_DURATION)
+        token = signin_token(cache, session_duration: session_duration)
+        build_url(
+          "Action" => "login",
+          "Issuer" => issuer,
+          "Destination" => destination_for(region),
+          "SigninToken" => token,
+        )
+      end
+
+      # Console home URL to land on after sign-in.
+      def destination_for(region)
+        return DEFAULT_DESTINATION if region.nil? || region.empty?
+        "https://#{region}.console.aws.amazon.com/console/home?region=#{region}"
+      end
+
+      # Opens the given URL in the default browser. Falls back to printing it
+      # (e.g. on a headless host where no opener is available).
+      def open_browser(url)
+        opener = browser_opener
+        if opener && system(*opener, url)
+          STDERR.puts "Opened the AWS Management Console in your browser."
+        else
+          STDERR.puts "Open the following URL in your browser to sign in (valid for 15 minutes):"
+          puts url
+        end
+      end
+
+      def request_signin_token(cache, session_duration)
+        session = {
+          sessionId: cache.access_key_id,
+          sessionKey: cache.secret_access_key,
+          sessionToken: cache.session_token,
+        }.to_json
+
+        params = { "Action" => "getSigninToken", "Session" => session }
+        params["SessionDuration"] = session_duration.to_s if session_duration
+        Net::HTTP.get_response(URI(build_url(params)))
+      end
+
+      def build_url(params)
+        uri = URI(ENDPOINT)
+        uri.query = URI.encode_www_form(params)
+        uri.to_s
+      end
+
+      def browser_opener
+        case RbConfig::CONFIG['host_os']
+        when /darwin/ then ["open"]
+        when /mswin|mingw|cygwin/ then ["cmd", "/c", "start", ""]
+        else ["xdg-open"]
+        end
+      end
+
+      module_function :signin_token, :signin_url, :destination_for, :open_browser, :request_signin_token, :build_url, :browser_opener
+    end
+  end
+end

data/lib/aws/asmr.rb

@@ -34,3 +34,5 @@ end
 
 require 'aws/asmr/cache'
 require 'aws/asmr/alias'
+require 'aws/asmr/local'
+require 'aws/asmr/web_login'

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: aws-asmr
 version: !ruby/object:Gem::Version
-  version: 0.0.4
+  version: 0.0.7
 platform: ruby
 authors:
 - metheglin
 autorequire:
 bindir: bin
 cert_chain: []
-date: 2026-04-10 00:00:00.000000000 Z
+date: 2026-09-03 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: rake
@@ -70,17 +70,22 @@ description: ''
 email: pigmybank@gmail.com
 executables:
 - asmr
+- asmr-login
 extensions: []
 extra_rdoc_files: []
 files:
 - README.md
 - bin/asmr
+- bin/asmr-login
 - lib/aws/asmr.rb
 - lib/aws/asmr/alias.rb
 - lib/aws/asmr/cache.rb
+- lib/aws/asmr/cli.rb
+- lib/aws/asmr/local.rb
 - lib/aws/asmr/options.rb
 - lib/aws/asmr/prompt.rb
 - lib/aws/asmr/version.rb
+- lib/aws/asmr/web_login.rb
 homepage: https://rubygems.org/gems/aws-asmr
 licenses:
 - MIT