aws_assume_role 0.0.3 → 0.1.0

data/aws_assume_role.gemspec

@@ -1,32 +1,46 @@
 # coding: utf-8
-lib = File.expand_path('../lib', __FILE__)
-$LOAD_PATH.unshift(lib) unless $LOAD_PATH.include?(lib)
-
+require_relative "lib/aws_assume_role/version"
 Gem::Specification.new do |spec|
-    spec.name          = 'aws_assume_role'
-    spec.version       = '0.0.3'
-    spec.authors       = ['Jon Topper', 'Jack Thomas']
-    spec.email         = ['jon@scalefactory.com', 'jack@scalefactory.com']
+    spec.name          = "aws_assume_role"
+    spec.version       = AwsAssumeRole::VERSION
+    spec.authors       = ["Jon Topper", "Jack Thomas", "Naadir Jeewa"]
+    spec.email         = ["jon@scalefactory.com", "jack@scalefactory.com", "naadir@scalefactory.com"]
 
-    spec.description   = 'Used to fetch multiple AWS Role Credential '\
-                         'Keys using different Session Keys '\
-                         'and store them securely using Gnome Keyring '\
-                         'or OSX keychain'
-    spec.summary       = 'Manage AWS STS credentials with MFA'
-    spec.homepage      = 'https://github.com/scalefactory/aws_assume_role'
-    spec.license       = 'MIT'
+    spec.description   = "Used to fetch multiple AWS Role Credential "\
+                         "Keys using different Session Keys "\
+                         "and store them securely using Gnome Keyring "\
+                         "or OSX keychain"
+    spec.summary       = "Manage AWS STS credentials with MFA"
+    spec.homepage      = "https://github.com/scalefactory/aws-assume-role"
+    spec.license       = "Apache-2.0"
 
     spec.files         = `git ls-files -z`.split("\x0").reject { |f|
         f.match(%r{^(test|spec|features)/})
     }
-    spec.bindir        = 'bin'
+    spec.bindir        = "bin"
     spec.executables   = spec.files.grep(%r{^bin/aws}) { |f| File.basename(f) }
-    spec.require_paths = ['lib']
+    spec.require_paths = ["lib"]
 
-    spec.add_runtime_dependency 'aws-sdk'
-    spec.add_runtime_dependency 'inifile'
-    spec.add_runtime_dependency 'keyring', '~> 0.4.1'
+    spec.add_runtime_dependency "activesupport", "~> 4.0"
+    spec.add_runtime_dependency "aws-sdk", "~> 2.7"
+    spec.add_runtime_dependency "dry-configurable", "~> 0.5"
+    spec.add_runtime_dependency "dry-initializer", "~> 1.1"
+    spec.add_runtime_dependency "dry-types", "~> 0.9"
+    spec.add_runtime_dependency "dry-validation", "~> 0.10"
+    spec.add_runtime_dependency "gli", "~> 2.15"
+    spec.add_runtime_dependency "highline", "~> 1.7"
+    spec.add_runtime_dependency "i18n", "~> 0.7"
+    spec.add_runtime_dependency "inifile", "~> 3.0"
+    spec.add_runtime_dependency "launchy", "~> 2.4"
+    spec.add_runtime_dependency "keyring", "~> 0.4", ">= 0.4.1"
+    spec.add_runtime_dependency "pastel", "~> 0.7"
+    spec.add_development_dependency "rubocop", "~> 0.46"
+    spec.add_development_dependency "yard", "~> 0.9"
 
-    # spec.add_development_dependency 'bundler', '~> 1.12'
-    # spec.add_development_dependency 'rake', '~> 10.0'
+    case Gem::Platform.local.os
+    when "linux"
+        spec.add_dependency "gir_ffi-gnome_keyring", "~> 0.0", ">= 0.0.3"
+    when "darwin"
+        spec.add_dependency "ruby-keychain", "~> 0.3", ">= 0.3.2"
+    end
 end

data/bin/aws-assume-role

@@ -1,84 +1,2 @@
 #!/usr/bin/env ruby
-
-$LOAD_PATH.unshift File.expand_path('../lib/', __FILE__)
-
-require 'optparse'
-require 'aws_assume_role'
-
-options = {}
-optparse = OptionParser.new do |opts|
-
-    options[:config] = "#{ENV['HOME']}/.aws/assume.yaml"
-    opts.on('-c', '--config file', 'Config file. defaults to' \
-                  '~/.aws/assume.yaml.') do |c|
-        options[:config] = c
-    end
-    
-    options[:profile] = false
-    opts.on('-p', '--profile name', 'Load the credentials for a profile into AWS ' \
-            'environment variables.') do |c|
-        options[:profile] = c
-    end
-
-    options[:add] = false
-    opts.on('-a', '--add', 'Add basic/parent account credentials to keystore' \
-            'environment variables. Must provide a profile name') do |c|
-        options[:add] = c
-    end
-
-    options[:delete] = false
-    opts.on('-d', '--delete', 'Delete credentials from keystore. Must ' \
-                  'provide a profile name.') do
-        options[:delete] = true
-    end
-
-    options[:debug] = false
-    opts.on('--debug', 'Enable debugging') do
-        options[:debug] = true
-    end
-
-    options[:verbose] = false
-    opts.on('-v', '--verbose', 'Get more words') do
-        options[:verbose] = true
-    end
-
-end
-
-optdata = optparse.parse!
-
-if options[:debug]
-    AWSAssumeRole::Profile.logger.level = Logger::DEBUG
-else
-    AWSAssumeRole::Profile.logger.level = Logger::WARN
-end
-
-
-begin
-    AWSAssumeRole::Profile.load_profiles
-    AWSAssumeRole::Profile.load_config_file(options[:config])
-rescue Errno::ENOENT
-    STDERR.puts "No config file at options[:config]. Please create one!"
-    exit -1 # rubocop:disable Lint/AmbiguousOperator
-end
-
-if options[:profile] != false
-    profile = AWSAssumeRole::Profile.get_by_name(options[:profile] )
-
-    if options[:delete]
-        profile.remove
-    elsif options[:add]
-        profile.add
-    else
-        profile.use
-    end
-
-    if options[:verbose]
-        system('env | grep "AWS" | sort')
-    end
-end
-
-unless optdata.empty?
-    cmd = optdata.join(' ')
-    AWSAssumeRole::Profile.logger.debug "Executing Command '#{cmd}'"
-    system(cmd)
-end
+require_relative "../lib/aws_assume_role/cli"

data/i18n/en.yml

@@ -0,0 +1,106 @@
+en:
+    commands:
+        configure:
+            desc: Configure AWS
+            long_desc: |
+                Configure  AWS  profiles. If this command is run with no arguments,
+                you will be prompted for configuration values such as your  AWS  Access
+                Key  Id  and you AWS Secret Access Key.  You can configure a named pro-
+                file using the --profile argument.  If your config file does not  exist
+                (the default location is ~/.aws/config), the AWS CLI will create it for
+                you.  To keep an existing value, hit enter when prompted for the value.
+                When  you  are prompted for information, the current value will be dis-
+                played in [brackets].  If the config item has no value, it be displayed
+                as  [None].  Note that the configure command only work with values from
+                the config file.  It does not use any configuration values  from  envi-
+                ronment variables or the IAM role.
+
+                Note:  The  values  you  provide  for the AWS Access Key ID and the AWS
+                Secret Access Key will be written to your keyring backend.
+            saved: Profile %s saved to %s
+        console:
+            desc: Launch the AWS console to switch to the profile role.
+            long_desc: |
+                Looks up the Role ARN in the profile, constructs the AWS console
+                URL and launches your browser with it. It's a convenience, doesn't
+                use any of the credentials.
+        set_environment:
+            desc: Export assumed credentials to your shell environment.
+            long_desc: |
+                Set up environment variables in your shell so that you can run AWS CLI
+                or other apps using those credentials without running aws-assume-role
+                again.
+                Supports Bourne, CSh, Fish and PowerShell.
+            shells:
+                powershell: Use `aws-assume-role environment set -s powershell -p <profile_name> | Invoke-Expression` to load into environment
+                others: Use `eval aws-assume-role environment set -p <profile_name>` to load into environment
+                fish: Use `set creds (bin/aws-assume-role environment set -s fish); eval $creds; set -e creds`
+        reset_environment:
+            desc: Delete AWS environment variables.
+            long_desc: |
+                Cleans up your shell environment by removing the following environment variables:
+                    AWS_ACCESS_KEY_ID
+                    AWS_SECRET_ACCESS_KEY
+                    AWS_DEFAULT_REGION
+                    AWS_PROFILE
+                    AWS_ASSUME_ROLE_LOG_LEVEL
+                    GLI_DEBUG
+                Supports Bourne, CSh, Fish and PowerShell.
+            shells:
+                powershell: Use `aws-assume-role environment reset -s powershell -p <profile_name> | Invoke-Expression` to load into environment
+                others: Use `eval aws-assume-role environment reset -p <profile_name>` to load into environment
+                fish: Use `set creds (bin/aws-assume-role environment reset -s fish); eval $creds; set -e creds`
+        run:
+            desc: Run a program with credentials set in the environment.
+        delete:
+            desc: Delete a profile
+            completed: "Profile %s deleted"
+            not_found: "Cannot find profile %s. Try running `aws-assume-role list`"
+        list:
+            desc: List configured profiles
+        migrate:
+            desc: Migrate a store to secure storage.
+            not_found: "Cannot find profile %s. Try running `aws-assume-role list`"
+            saved: Profile %s migrated within %s
+        test:
+            desc: Check that credentials work
+            output: |
+                Logged in as:
+                    User: %s
+                    Account: %s
+                    ARN: %s
+    options:
+        aws_access_key_id: "Enter the AWS Access Key ID to use for this profile"
+        aws_secret_access_key: "Enter the AWS Secret Access Key to use for this profile"
+        region: Enter the AWS region you would like to default to
+        profile_name: Enter the profile name to save into configuration
+        mfa_token:
+            first_time: "Please provide an MFA token"
+            other_times: "Credentials have expired, please provide another MFA"
+        default_role: "A default role to assume (leave blank to not use)"
+        external_id: String provided by the external account holder to uniquely identify you.
+        source_profile: Which profile to use to assume this role.
+        role_session_name: Name to uniquely identify your session
+        mfa_serial: The identification number of the MFA device. Leave blank to determine dynamically at run time.
+        role_arn: The Amazon Resource Name (ARN) of the role to assume.
+        duration_seconds: Default session length
+        shell_type: What type of shell to use.
+        name_to_delete: Please type the name of the profile, i.e. %s , to continue deletion.
+    program_description: "A tool for AWS credential management"
+    errors:
+        NoSuchProfileError: Profile %s not found in shared configuration.
+        MissingCredentialsError: No credentials found!
+        rules:
+            profile:
+                filled?: --profile must be specified.
+            role-arn:
+                format?: "--role-arn must be specified as an ARN in the format `arn:aws:iam::account-id:role/role-name`"
+                filled?: --role-arn is required.
+            serial-number:
+                format?: "--mfa-serial must be specified as an ARN in the format `arn:aws:iam::account-id:mfa/virtual-device-name`"
+                filled?: --mfa-serial is required.
+            region:
+                format?: "--region must be a valid AWS Standard, China or GovCloud region"
+                filled?: --region is required
+            role_specification:
+                filled?: "Either specify --profile OR (--role-arn AND --role-session-name, or neither)"

data/lib/aws_assume_role.rb

@@ -1,3 +1,2 @@
-require 'aws_assume_role/logging'
-require 'aws_assume_role/profile'
-require 'aws_assume_role/credentials'
+require_relative "aws_assume_role/store/shared_config_with_keyring"
+require_relative "aws_assume_role/credentials/factories/default_chain_provider"

data/lib/aws_assume_role/cli.rb

@@ -0,0 +1,15 @@
+require_relative "includes"
+require_relative "ui"
+
+module AwsAssumeRole::Cli
+    include GLI::DSL
+    include GLI::App
+    include AwsAssumeRole
+    include AwsAssumeRole::Ui
+    extend self # rubocop:disable Style/ModuleFunction
+
+    commands_from File.join(File.realpath(__dir__), "cli", "commands")
+    program_desc t "program_description"
+
+    exit run(ARGV)
+end

data/lib/aws_assume_role/cli/actions/abstract_action.rb

@@ -0,0 +1,53 @@
+require_relative "includes"
+require_relative "../../profile_configuration"
+
+class AwsAssumeRole::Cli::Actions::AbstractAction
+    include AwsAssumeRole
+    include AwsAssumeRole::Types
+    include Ui
+    CommandSchema = proc { raise "CommandSchema Not implemented" }
+
+    def initialize(global_options, options, args)
+        config = ProfileConfiguration.new_from_cli(global_options, options, args)
+        result = validate_options(config.to_h.deep_symbolize_keys)
+        return act_on(config) if result.success?
+        Ui.show_validation_errors result
+    end
+
+    private
+
+    def try_for_credentials(config)
+        @provider ||= AwsAssumeRole::Credentials::Factories::DefaultChainProvider.new(config.to_h)
+        creds = @provider.resolve(nil_with_role_not_set: true)
+        return creds unless creds.nil?
+    rescue NoMethodError
+        error "Cannot find any credentials"
+        exit 404
+    end
+
+    def resolved_region
+        @provider.region
+    end
+
+    def resolved_profile
+        @provider.profile
+    end
+
+    def validate_options(options)
+        command_schema = self.class::CommandSchema
+        ::Dry::Validation.Schema do
+            configure { config.messages = :i18n }
+            instance_eval(&command_schema)
+        end.call(options)
+    end
+
+    def prompt_for_option(key, option_name, validator, fmt: nil)
+        text_lookup = t("options.#{key}")
+        text = fmt.nil? ? text_lookup : format(text_lookup, fmt)
+        Ui.ask_with_validation(option_name, text) { instance_eval(&validator) }
+    end
+
+    def act_on(_options)
+        raise "Act On Not Implemented"
+    end
+end

data/lib/aws_assume_role/cli/actions/configure_profile.rb

@@ -0,0 +1,21 @@
+require_relative "abstract_action"
+require_relative "../../store/shared_config_with_keyring"
+
+class AwsAssumeRole::Cli::Actions::ConfigureProfile < AwsAssumeRole::Cli::Actions::AbstractAction
+    CommandSchema = proc do
+        required(:profile)
+        optional(:region) { filled? > format?(REGION_REGEX) }
+        optional(:mfa_serial)
+        optional(:profile_name)
+    end
+
+    def act_on(config)
+        new_hash = config.to_h
+        profile = config.profile || prompt_for_option(:profile_name, "profile", proc { filled? })
+        new_hash[:region] = prompt_for_option(:region, "region", proc { filled? > format?(REGION_REGEX) })
+        new_hash[:aws_access_key_id] = prompt_for_option(:aws_access_key_id, "aws_access_key_id", ACCESS_KEY_VALIDATOR)
+        new_hash[:aws_secret_access_key] = prompt_for_option(:aws_secret_access_key, "aws_secret_access_key", proc { filled? })
+        AwsAssumeRole.shared_config.save_profile(profile, new_hash)
+        out format(t("commands.configure.saved"), config.profile, AwsAssumeRole.shared_config.config_path)
+    end
+end

data/lib/aws_assume_role/cli/actions/configure_role_assumption.rb

@@ -0,0 +1,19 @@
+require_relative "abstract_action"
+
+class AwsAssumeRole::Cli::Actions::ConfigureRoleAssumption < AwsAssumeRole::Cli::Actions::AbstractAction
+    CommandSchema = proc do
+        required(:profile)
+        required(:source_profile) { str? }
+        optional(:region) { filled? > format?(REGION_REGEX) }
+        optional(:serial_number) { filled? > format?(MFA_REGEX) }
+        required(:role_session_name).filled?
+        required(:role_arn) { filled? & format?(ROLE_REGEX) }
+        required(:external_id).filled?
+        required(:duration_seconds).filled?
+    end
+
+    def act_on(config)
+        AwsAssumeRole.shared_config.save_profile(config.profile, config.to_h.compact)
+        out format(t("commands.configure.saved"), config.profile, AwsAssumeRole.shared_config.config_path)
+    end
+end

data/lib/aws_assume_role/cli/actions/console.rb

@@ -0,0 +1,68 @@
+require_relative "includes"
+require_relative "../../runner"
+require "cgi"
+require "json"
+
+class AwsAssumeRole::Cli::Actions::Console < AwsAssumeRole::Cli::Actions::AbstractAction
+    include AwsAssumeRole::Ui
+    include AwsAssumeRole::Logging
+
+    FEDERATION_URL = "https://signin.aws.amazon.com/federation".freeze
+    CONSOLE_URL = "https://console.aws.amazon.com".freeze
+    GENERIC_SIGNIN_URL = "https://signin.aws.amazon.com/console".freeze
+    SIGNIN_URL = [FEDERATION_URL, "?Action=getSigninToken", "&Session=%s"].join
+    LOGIN_URL = [FEDERATION_URL, "?Action=login", "&Destination=%s", "&SigninToken=%s"].join
+
+    CommandSchema = proc do
+        required(:profile).maybe
+        optional(:region) { filled? > format?(REGION_REGEX) }
+        optional(:serial_number) { filled? > format?(MFA_REGEX) }
+        required(:role_arn).maybe
+        required(:role_session_name).maybe
+        required(:duration_seconds).maybe
+        rule(role_specification: [:profile, :role_arn, :role_session_name, :duration_seconds]) do |p, r, s, d|
+            (p.filled? | p.empty? & r.filled?) & (r.filled? > s.filled? & d.filled?)
+        end
+    end
+
+    def try_federation(config)
+        credentials = try_for_credentials config.to_h
+        return unless credentials.set?
+        session = session_json(credentials)
+        signin_url = format SIGNIN_URL, CGI.escape(session)
+        sso_token = JSON.parse(URI.parse(signin_url).read)["SigninToken"]
+        format LOGIN_URL, CGI.escape(CONSOLE_URL), CGI.escape(sso_token)
+    rescue OpenURI::HTTPError
+        error "Error getting federated session, forming simple switch URL instead"
+    end
+
+    def session_json(credentials)
+        {
+            sessionId: credentials.credentials.access_key_id,
+            sessionKey: credentials.credentials.secret_access_key,
+            sessionToken: credentials.credentials.session_token,
+        }.to_json
+    end
+
+    def try_switch_url(config)
+        profile = AwsAssumeRole.shared_config.determine_profile(profile_name: config.profile)
+        config_section = AwsAssumeRole.shared_config.parsed_config[profile]
+        raise Aws::Errors::NoSuchProfileError if config_section.nil?
+        resolved_role_arn = config.role_arn || config_section.fetch("role_arn", nil)
+        return unless resolved_role_arn
+        components = resolved_role_arn.split(":")
+        account = components[4]
+        role = components[5].split("/").last
+        display_name = config.profile || "#{account}_#{role}"
+        format "https://signin.aws.amazon.com/switchrole?account=%s&roleName=%s&displayName=%s", account, role, display_name
+    end
+
+    def act_on(config)
+        final_url = try_federation(config) || try_switch_url(config) || CONSOLE_URL
+        Launchy.open final_url
+    rescue KeyError, Aws::Errors::NoSuchProfileError
+        error format(t("errors.NoSuchProfileError"), config.profile)
+    rescue Aws::Errors::MissingCredentialsError
+        error t("errors.MissingCredentialsError")
+    end
+end