aws-mfa-secure 0.4.0 → 0.4.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: eb1c19a61a9e1136a1bf492d4fe5ad00c9c95ae759700ea06557b973cf8c60f2
-  data.tar.gz: ef90306a2465e7f3085d9211bbd0b5543d4d19b77dba6fc58c37f7280c290615
+  metadata.gz: e66bc2f12700653f9b9bfd044cfab1432726f29209f5204c53ca788d54a86b0b
+  data.tar.gz: 0fd9d8501d6d5c29f18417bd1e547972023e9dc836a29718d834f5567a95b994
 SHA512:
-  metadata.gz: '085b0235ca5c7213f9bd7fd2214726aa6fbf6936500a3f7588ddce044f78750f520075b6b51e40cc1f70e9ac7f71a8ba4bedbd7116a9c3c0bb2e56343b6d6587'
-  data.tar.gz: e3d01b93f034cac3206485de2694a61d996667e215ed86b3200a977a5dc75ac1549d1bfc521304effd726c4c9d26d2f63a96b56b59ee9206869444b308663bd9
+  metadata.gz: b8d1d77709dd02f91b5e3ea798dfcccdf12e6264bd07328d342440a4e6c027f41e8533378e3ca919a6a8e94ad689394a1970d3a3b6955d7772ed3cb6208bd4be
+  data.tar.gz: d3c13915fee57d807e567a86c10410646397e2b5bc62bb8309631b4bd9079b1a6d16ef3a316b88e7157bd303d317b44ccad3fe1eb2d393f47d144718765dd6ec

data/CHANGELOG.md

@@ -3,6 +3,9 @@
 All notable changes to this project will be documented in this file.
 This project *tries* to adhere to [Semantic Versioning](http://semver.org/), even before v1.0.
 
+## [0.4.1]
+- #3 no-mfa option for exports
+
 ## [0.4.0]
 - #2 do not eager load ext/aws.rb
 

data/README.md

@@ -8,6 +8,8 @@
 
 Surprisingly, the [aws cli](https://docs.aws.amazon.com/cli/latest/reference/) does not yet support MFA for normal IAM users. See: [boto/botocore/pull/1399](https://github.com/boto/botocore/pull/1399)  The aws-mfa-secure tool decorates the AWS CLI or API to handle MFA authentication.  The MFA prompt only activates if `mfa_serial` is configured.
 
+An advantage of the aws-mfa-secure is that it caches the temporary credentials `~/.aws/aws-mfa-secure-sessions` and reuses them until they expire. The expiration is 8 hours by default. This means that when you open a new terminal tab, you won’t have to re-enter the MFA code.
+
 ## Installation
 
     gem install aws-mfa-secure
@@ -41,7 +43,7 @@ Note: AWS already supports `mfa_serial` for assumed roles: [AWS Configuration an
 
     alias aws="aws-mfa-secure session"
 
-You may want to add the alias to your `~/.bash_profile`
+The alias allows us to intercept the normal aws cli command and decorate it. The `aws-mfa-secure session` only activates if `mfa_serial` is configured in your `~/.aws/credentials` file. Otherwise, it will pass the command through to the normal aws cli.  You may want to add the alias to your `~/.bash_profile` do you don't have to alias it every time you open a new terminal.
 
 Autocompletion still works with the alias.
 

data/lib/aws_mfa_secure/cli.rb

@@ -8,6 +8,7 @@ module AwsMfaSecure
 
     desc "exports", "Generate export statements that can be eval"
     long_desc Help.text(:exports)
+    option :mfa, type: :boolean, desc: "Use --no-mfa to bypass the mfa_profile check for a normal get session token call"
     def exports
       Exports.new(options).run
     end

data/lib/aws_mfa_secure/exports.rb

@@ -6,6 +6,15 @@ module AwsMfaSecure
     end
 
     def run
+      # Allow use `aws-mfa-secure exports --no-mfa`
+      # This bypasses the check for mfa_serial being configured in the ~/.aws/credentials profile
+      # Useful if we want to grab temporary AWS_xxx credentials for testing.
+      if @options[:mfa] == false
+        resp = sts.get_session_token
+        puts script(resp.credentials)
+        return
+      end
+
       unless iam_mfa?
         $stderr.puts "WARN: mfa_serial is not configured for this AWS_PROFILE=#{@aws_profile}"
         return
@@ -16,14 +25,14 @@ module AwsMfaSecure
         save_creds(resp.credentials.to_h)
       end
 
-      puts script
+      puts script(credentials)
     end
 
-    def script
+    def script(creds)
       <<~EOL
-        export AWS_ACCESS_KEY_ID=#{credentials["access_key_id"]}
-        export AWS_SECRET_ACCESS_KEY=#{credentials["secret_access_key"]}
-        export AWS_SESSION_TOKEN=#{credentials["session_token"]}
+        export AWS_ACCESS_KEY_ID=#{creds["access_key_id"]}
+        export AWS_SECRET_ACCESS_KEY=#{creds["secret_access_key"]}
+        export AWS_SESSION_TOKEN=#{creds["session_token"]}
       EOL
     end
   end

data/lib/aws_mfa_secure/version.rb

@@ -1,3 +1,3 @@
 module AwsMfaSecure
-  VERSION = "0.4.0"
+  VERSION = "0.4.1"
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: aws-mfa-secure
 version: !ruby/object:Gem::Version
-  version: 0.4.0
+  version: 0.4.1
 platform: ruby
 authors:
 - Tung Nguyen
 autorequire: 
 bindir: exe
 cert_chain: []
-date: 2019-12-09 00:00:00.000000000 Z
+date: 2020-03-29 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: activesupport
@@ -243,7 +243,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 3.0.6
+rubygems_version: 3.1.2
 signing_key: 
 specification_version: 4
 summary: Adds MFA Support to AWS CLI and Ruby SDKs for normal IAM user