aws-mfa-secure 0.1.0 → 0.2.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 373259274cc623e8bb6b7ca2e044be59ea2abaa6c09f268bdf5376518b04baff
-  data.tar.gz: 8a59132aa173779f10f17d7e5d9ce4eedcb50ae304b6c8624f8db3e37dd79bbe
+  metadata.gz: 8c9d8a66e1c28de429063690051bc89c34d92aa9aa0667e538d95083ea4f72c3
+  data.tar.gz: fe4597dcaf3cb1cdfacf99e21a86403a5c5e2cd122e16a0fc971d1ddd5cc1a2f
 SHA512:
-  metadata.gz: 890158626d55398170a6904f1c2e19ce863a52caee43dd458f7d17967c9e73d0039676fcc3c0f36cd05658aee6ac6152fd568c80edb0b65e048812b98e379104
-  data.tar.gz: 9e09d81ad7ec37a89e4e4e5c0305c0e9f4367286ccc7d5664c90aa7aa6a3e38921b2f3b850442dfa4dd023920ff0d8dd77f516f6231b63b9029de31c8914684c
+  metadata.gz: e13b9de3cde7d9e39405acf453288a8f387bdb5b60998079e73295f80bbd7595147a75e15694b27cb18cfc88d4b13f0114852fd34bfdbb62949d362317f5b801
+  data.tar.gz: dc110c7877b6e525e7890e3278b6bd41a74f471d7e5a5573c4f95bdd24d313e66ed431574740c7a284a65f5bcd10cb78ec59c8d2846c3df706f1813f11df6fae

data/CHANGELOG.md

@@ -3,5 +3,9 @@
 All notable changes to this project will be documented in this file.
 This project *tries* to adhere to [Semantic Versioning](http://semver.org/), even before v1.0.
 
+## [0.2.0]
+- add clean command
+- flush memo cache for updated aws tokens
+
 ## [0.1.0]
 - Initial release.

data/README.md

@@ -2,7 +2,7 @@
 
 [![Gem Version](https://badge.fury.io/rb/aws-mfa-secure.png)](http://badge.fury.io/rb/aws-mfa-secure)
 
-Surprisingly, the [aws cli](https://docs.aws.amazon.com/cli/latest/reference/) does not yet support MFA for normal IAM users. See: https://github.com/boto/botocore/pull/1399  The aws-mfa-secure tool decorates the AWS CLI or API to handle MFA authentication.  The MFA prompt only activates if `mfa_serial` is configured.
+Surprisingly, the [aws cli](https://docs.aws.amazon.com/cli/latest/reference/) does not yet support MFA for normal IAM users. See: [boto/botocore/pull/1399](https://github.com/boto/botocore/pull/1399)  The aws-mfa-secure tool decorates the AWS CLI or API to handle MFA authentication.  The MFA prompt only activates if `mfa_serial` is configured.
 
 ## Installation
 
@@ -18,7 +18,7 @@ Prerequisite: The [AWS CLI](https://docs.aws.amazon.com/cli/latest/reference/) i
 
 1. Configure `~/.aws/credentials` with `mfa_serial`
 2. Set up bash alias
-3. Use aws cli like normal
+3. Use aws cli like you normally would
 
 ### Configure ~/.aws/credentials with mfa_serial
 
@@ -31,7 +31,7 @@ Set up `mfa_serial` in credentials file for the profile section that requires it
     aws_secret_access_key = ABCDl4hXikfOHTvNqFAnb2Ea62bUuu/eUEXAMPLE
     mfa_serial = arn:aws:iam::112233445566:mfa/MFAUser
 
-Note: AWS already supports `mfa_serial` assumed roles: [AWS Configuration and Credential File Settings](https://docs.aws.amazon.com/cli/latest/userguide/cli-configure-files.html).  The aws-mfa-secure tool does not decorate for assumed roles and lets the AWS CLI or SDK handle it.
+Note: AWS already supports `mfa_serial` for assumed roles: [AWS Configuration and Credential File Settings](https://docs.aws.amazon.com/cli/latest/userguide/cli-configure-files.html).  The aws-mfa-secure tool does not decorate for assumed roles and lets the AWS CLI or SDK handle it.  The aws-mfa-secure tool adds support for standard IAM users, which is not currently supported. See: [boto/botocore/pull/1399](https://github.com/boto/botocore/pull/1399)
 
 ### Set up bash alias
 
@@ -41,7 +41,7 @@ You may want to add the alias to your `~/.bash_profile`
 
 Autocompletion still works with the alias.
 
-### Use aws cli like normal
+### Use aws cli like usual
 
 Call `aws` command like you usually would:
 
@@ -78,7 +78,7 @@ Except `aws-mfa-secure session` will use the temporary session environment `AWS_
 
 ## Exports
 
-You can also generate the exports script.
+You can also generate an exports script. The exports technique is useful for tools that do not yet support MFA.  Using `AWS_*` env variables for credentials should allow those tools to work. Though, it may depend on the tool as they sometimes hardcode a credentials configuration.  Example:
 
     $ aws-mfa-secure exports
     Please provide your MFA code: 147280
@@ -107,11 +107,11 @@ This patches the aws-sdk-ruby library and adds MFA support.
 
 You can also set the MFA info with env variables. They take the highest precedence and override what's in `~/.aws/credentials`. Example:
 
-    AWS_MFA_TOKEN=112233 arn:aws:iam::112233445566:mfa/MFAUser aws s3 ls
+    AWS_MFA_TOKEN=112233 AWS_MFA_SERIAL=arn:aws:iam::112233445566:mfa/MFAUser aws s3 ls
 
 ## How It Works
 
-docs: [How It Works](docs/how-it-works.md)
+Docs: [How It Works](docs/how-it-works.md)
 
 ## Related
 

data/lib/aws_mfa_secure.rb

@@ -1,11 +1,15 @@
 $:.unshift(File.expand_path("../", __FILE__))
 require "aws_mfa_secure/version"
+require "active_support/core_ext/hash"
+require "active_support/core_ext/string"
+require "fileutils"
 require "rainbow/ext/string"
 
 require "aws_mfa_secure/autoloader"
 AwsMfaSecure::Autoloader.setup
 
 module AwsMfaSecure
+  SESSIONS_PATH = "#{ENV['HOME']}/.aws/aws-mfa-secure-sessions"
   class Error < StandardError; end
 end
 

data/lib/aws_mfa_secure/base.rb

@@ -1,10 +1,7 @@
 require "aws-sdk-core"
-require "fileutils"
 require "json"
 require "memoist"
 require "time"
-require "active_support/core_ext/string"
-require "active_support/core_ext/hash"
 
 module AwsMfaSecure
   class MfaError < StandardError; end
@@ -44,10 +41,11 @@ module AwsMfaSecure
     def save_creds(credentials)
       FileUtils.mkdir_p(File.dirname(session_creds_path))
       IO.write(session_creds_path, JSON.pretty_generate(credentials))
+      flush_cache # Clear memo cache. Not needed for brand new temp credentials, but needed when updating existing ones
     end
 
     def session_creds_path
-      "#{ENV['HOME']}/.aws/aws-mfa-secure-sessions/#{@aws_profile}"
+      "#{SESSIONS_PATH}/#{@aws_profile}"
     end
 
     def get_session_token(shell: false)
@@ -61,7 +59,7 @@ module AwsMfaSecure
         options[:duration_seconds] = ENV['AWS_MFA_TTL'] if ENV['AWS_MFA_TTL']
 
         if shell
-          shell_get_session_token(options, token_code) # mimic ruby sdk
+          shell_get_session_token(options) # mimic ruby sdk
         else # ruby sdk
           sts.get_session_token(options)
         end
@@ -87,7 +85,8 @@ module AwsMfaSecure
       $stdin.gets.strip
     end
 
-    def shell_get_session_token(options, token_code)
+    # Credentials class uses this version of get-session-token to allow the AWS Ruby SDK itself to be patched.
+    def shell_get_session_token(options)
       args = options.map { |k,v| "--#{k.to_s.gsub('_','-')} #{v}" }.join(' ')
       command = "aws sts get-session-token #{args} 2>&1"
       # puts "=> #{command}" # uncomment for debugging

data/lib/aws_mfa_secure/clean.rb

@@ -0,0 +1,12 @@
+module AwsMfaSecure
+  class Clean
+    def initialize(options)
+      @options = options
+    end
+
+    def run
+      FileUtils.rm_rf(SESSIONS_PATH)
+      puts "Removed #{SESSIONS_PATH}"
+    end
+  end
+end

data/lib/aws_mfa_secure/cli.rb

@@ -18,6 +18,12 @@ module AwsMfaSecure
       Unsets.new(options).run
     end
 
+    desc "clean", "Cleans/purges the ~/.aws/aws-mfa-secure-sessions"
+    long_desc Help.text(:clean)
+    def clean
+      Clean.new(options).run
+    end
+
     desc "completion *PARAMS", "Prints words for auto-completion."
     long_desc Help.text("completion")
     def completion(*params)

data/lib/aws_mfa_secure/version.rb

@@ -1,3 +1,3 @@
 module AwsMfaSecure
-  VERSION = "0.1.0"
+  VERSION = "0.2.0"
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: aws-mfa-secure
 version: !ruby/object:Gem::Version
-  version: 0.1.0
+  version: 0.2.0
 platform: ruby
 authors:
 - Tung Nguyen
 autorequire: 
 bindir: exe
 cert_chain: []
-date: 2019-11-09 00:00:00.000000000 Z
+date: 2019-11-10 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: activesupport
@@ -188,6 +188,7 @@ files:
 - lib/aws_mfa_secure.rb
 - lib/aws_mfa_secure/autoloader.rb
 - lib/aws_mfa_secure/base.rb
+- lib/aws_mfa_secure/clean.rb
 - lib/aws_mfa_secure/cli.rb
 - lib/aws_mfa_secure/command.rb
 - lib/aws_mfa_secure/completer.rb