aws-mfa-secure 0.3.7 → 0.4.3

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 66ffdf370150a2faa8dd385f187822633ba16bea532b359bc219443ec2b34ded
-  data.tar.gz: 1a2f3e0d2632fbc3ddd650ee9dd04677ccea305fe30d1b8e99b85a301337e911
+  metadata.gz: 402fd832cf07be964b75d2a30a96600b65956e11979d02595d8e74725970a232
+  data.tar.gz: edc70a0647f6f73de89d02e83e788fc922f4c189a29c47b94a7efad33410fe25
 SHA512:
-  metadata.gz: 7ddd72b31ee4374e113c711333217dc07e385850ce641bf94d636689c788e1b93e73527d9c89194364846131f8d504ed3b4a88d9038963894e9c937a66bf2ad8
-  data.tar.gz: 4cc98c88e78e3e43c54ee2458cc3d79eda0b18794adf644e727d6fa4de270b7c1b2874360b7ef6c481ce9689aa742bc0c10c593b0ea19d26c4554a22ed28f3cd
+  metadata.gz: 51f145fe9a979d65cd54086e84e98c66050cb148fd45e39bbf766ade2d7d4175472580946761517a32d5749e2ab0dee37866e542450b428847b1c4c91d91d013
+  data.tar.gz: 8b471f3641a3d92f7b0f507fe6049c6f3c70b1e6bfb5ec451d114c74c257896191a1bd6ef944701bf02ba14db3e520895dba801a6e0c673962f099648a6d3665

data/CHANGELOG.md

@@ -3,6 +3,21 @@
 All notable changes to this project will be documented in this file.
 This project *tries* to adhere to [Semantic Versioning](http://semver.org/), even before v1.0.
 
+## [0.4.3] - 2020-12-10
+- [#4](https://github.com/tongueroo/aws-mfa-secure/pull/4) require singleton
+
+## [0.4.2]
+- add helpful message
+
+## [0.4.1]
+- #3 no-mfa option for exports
+
+## [0.4.0]
+- #2 do not eager load ext/aws.rb
+
+## [0.3.8]
+- fix edge case when aws profile not found
+
 ## [0.3.7]
 - check aws cli is fully setup
 

data/README.md

@@ -4,8 +4,12 @@
 
 [![Gem Version](https://badge.fury.io/rb/aws-mfa-secure.png)](http://badge.fury.io/rb/aws-mfa-secure)
 
+[![BoltOps Badge](https://img.boltops.com/boltops/badges/boltops-badge.png)](https://www.boltops.com)
+
 Surprisingly, the [aws cli](https://docs.aws.amazon.com/cli/latest/reference/) does not yet support MFA for normal IAM users. See: [boto/botocore/pull/1399](https://github.com/boto/botocore/pull/1399)  The aws-mfa-secure tool decorates the AWS CLI or API to handle MFA authentication.  The MFA prompt only activates if `mfa_serial` is configured.
 
+An advantage of the aws-mfa-secure is that it caches the temporary credentials `~/.aws/aws-mfa-secure-sessions` and reuses them until they expire. The expiration is 8 hours by default. This means that when you open a new terminal tab, you won’t have to re-enter the MFA code.
+
 ## Installation
 
     gem install aws-mfa-secure
@@ -13,7 +17,7 @@ Surprisingly, the [aws cli](https://docs.aws.amazon.com/cli/latest/reference/) d
 Prerequisite: The [AWS CLI](https://docs.aws.amazon.com/cli/latest/reference/) is required. You can install the AWS CLI via pip.
 
     pip install awscli --upgrade --user
-    
+
 ## Usage
 
 **Summary**:
@@ -39,7 +43,7 @@ Note: AWS already supports `mfa_serial` for assumed roles: [AWS Configuration an
 
     alias aws="aws-mfa-secure session"
 
-You may want to add the alias to your `~/.bash_profile`
+The alias allows us to intercept the normal aws cli command and decorate it. The `aws-mfa-secure session` only activates if `mfa_serial` is configured in your `~/.aws/credentials` file. Otherwise, it will pass the command through to the normal aws cli.  You may want to add the alias to your `~/.bash_profile` do you don't have to alias it every time you open a new terminal.
 
 Autocompletion still works with the alias.
 

data/lib/aws_mfa_secure/autoloader.rb

@@ -13,8 +13,10 @@ module AwsMfaSecure
       def setup
         loader = Zeitwerk::Loader.new
         loader.inflector = Inflector.new
-        loader.push_dir(File.dirname(__dir__)) # lib
-        loader.ignore("#{File.dirname(__dir__)}/aws-mfa-secure.rb")
+        lib = File.dirname(__dir__) # lib
+        loader.push_dir(lib)
+        loader.ignore("#{lib}/aws-mfa-secure.rb")
+        loader.do_not_eager_load("#{lib}/aws_mfa_secure/ext/aws.rb")
         loader.setup
       end
     end

data/lib/aws_mfa_secure/base.rb

@@ -132,7 +132,9 @@ module AwsMfaSecure
     memoize :sts
 
     def aws_config(prop)
-      v = AWSConfig[aws_profile][prop.to_s]
+      profile_data = AWSConfig[aws_profile]
+      return unless profile_data
+      v = profile_data[prop.to_s]
       v unless v.blank?
     end
     memoize :aws_config

data/lib/aws_mfa_secure/cli.rb

@@ -8,6 +8,7 @@ module AwsMfaSecure
 
     desc "exports", "Generate export statements that can be eval"
     long_desc Help.text(:exports)
+    option :mfa, type: :boolean, desc: "Use --no-mfa to bypass the mfa_profile check for a normal get session token call"
     def exports
       Exports.new(options).run
     end

data/lib/aws_mfa_secure/credentials.rb

@@ -1,3 +1,5 @@
+require "singleton"
+
 # Useful for Ruby interfacing
 module AwsMfaSecure
   class Credentials < Base

data/lib/aws_mfa_secure/exports.rb

@@ -6,8 +6,18 @@ module AwsMfaSecure
     end
 
     def run
+      # Allow use `aws-mfa-secure exports --no-mfa`
+      # This bypasses the check for mfa_serial being configured in the ~/.aws/credentials profile
+      # Useful if we want to grab temporary AWS_xxx credentials for testing.
+      if @options[:mfa] == false
+        resp = sts.get_session_token
+        puts script(resp.credentials)
+        return
+      end
+
       unless iam_mfa?
         $stderr.puts "WARN: mfa_serial is not configured for this AWS_PROFILE=#{@aws_profile}"
+        $stderr.puts "If you want to use exports without this mfa_serial check. Use the --no-mfa option."
         return
       end
 
@@ -16,14 +26,14 @@ module AwsMfaSecure
         save_creds(resp.credentials.to_h)
       end
 
-      puts script
+      puts script(credentials)
     end
 
-    def script
+    def script(creds)
       <<~EOL
-        export AWS_ACCESS_KEY_ID=#{credentials["access_key_id"]}
-        export AWS_SECRET_ACCESS_KEY=#{credentials["secret_access_key"]}
-        export AWS_SESSION_TOKEN=#{credentials["session_token"]}
+        export AWS_ACCESS_KEY_ID=#{creds["access_key_id"]}
+        export AWS_SECRET_ACCESS_KEY=#{creds["secret_access_key"]}
+        export AWS_SESSION_TOKEN=#{creds["session_token"]}
       EOL
     end
   end

data/lib/aws_mfa_secure/version.rb

@@ -1,3 +1,3 @@
 module AwsMfaSecure
-  VERSION = "0.3.7"
+  VERSION = "0.4.3"
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: aws-mfa-secure
 version: !ruby/object:Gem::Version
-  version: 0.3.7
+  version: 0.4.3
 platform: ruby
 authors:
 - Tung Nguyen
 autorequire: 
 bindir: exe
 cert_chain: []
-date: 2019-11-14 00:00:00.000000000 Z
+date: 2020-12-10 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: activesupport
@@ -243,7 +243,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 3.0.6
+rubygems_version: 3.1.4
 signing_key: 
 specification_version: 4
 summary: Adds MFA Support to AWS CLI and Ruby SDKs for normal IAM user