aws_assume_role 1.1.0-universal-freebsd

data/README.md

@@ -0,0 +1,303 @@
+aws-assume-role
+---------------
+[![Build Status](https://travis-ci.org/scalefactory/aws-assume-role.svg?branch=master)](https://travis-ci.org/scalefactory/aws-assume-role)
+[![Coverage Status](https://coveralls.io/repos/github/scalefactory/aws-assume-role/badge.svg?branch=master)](https://coveralls.io/github/scalefactory/aws-assume-role?branch=master)
+[![Code Climate](https://codeclimate.com/github/scalefactory/aws-assume-role/badges/gpa.svg)](https://codeclimate.com/github/scalefactory/aws-assume-role)
+[![Gem Version](https://badge.fury.io/rb/aws_assume_role.svg)](https://badge.fury.io/rb/aws_assume_role)
+
+aws-assume-role is a utility intended for developer and operator environments
+who need to use 2FA and role assumption to access AWS services.
+
+aws-assume-role can store both AWS access keys and ephemeral session tokens in
+OS credential vaults - Keychain on OSX and Keyring on Gnome.
+
+Why?
+---
+
+This keeps your credentials safe in the keystore, and exist as
+environment variables for the duration and context of the executing command.
+This helps prevent credential leaking and theft, and means they aren't stored on
+disk as unencrypted files.
+
+It allows easy credential management and role assumption with a 2FA/MFA device.
+
+For more information on role assumption, see the [AWS documentation](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_use.html).
+
+Requirements
+------------
+*   Ruby ≥ 2.2
+*   macOS Keychain / GNOME Keyring
+*   At least one account with Amazon Web Services
+*   An IAM role configured in the target account
+*   An IAM user with rights to assume that role
+
+Install
+-------
+
+```sh
+gem install aws_assume_role
+```
+
+### Platform notes
+
+Gnome Keyring uses the [GirFFI](https://github.com/mvz/gir_ffi) bindings, which
+require introspection bindings as well as Gnone Keyring, by installing one of the following packages:
+
+``` sh
+# Debian/Ubuntu
+apt-get install gnome-keyring libgirepository1.0-dev libgnome-keyring-common libgnome-keyring-dev
+
+# Fedora
+dnf install gobject-introspection-devel
+
+# CentOS
+yum install gobject-introspection-devel
+```
+Setup
+-----
+
+You should already have an IAM user that you can log in to via AWS' console.
+If you do not already have an AWS access key and matching secret key for your
+own IAM user, use the AWS console to create that credential pair.
+
+aws-assume-role works best if you also store permanent credentials in your keystore:
+
+``` sh
+> aws-assume-role configure
+Enter the profile name to save into configuration
+company_sso
+Enter the AWS region you would like to default to:
+eu-west-1
+Enter the AWS Access Key ID to use for this profile:
+1234567890010
+Enter the AWS Secret Access Key to use for this profile:
+abcdefghijklmnopqrstuvwzyx1
+Profile `company_sso` saved to '/home/growthsmith/.aws/config'
+```
+
+### Configuring roles
+Now that you've set up permanent credentials in your OS credential store, you can now
+set up a role that you will assume in every day use:
+
+``` sh
+> aws-assume-role configure role -p company-dev --source-profile company_sso  \
+--role-arn=arn:aws:iam::000000000001:role/ViewEC2 --role-session-name=growthsmith \
+--mfa-serial automatic
+```
+`--mfa-serial automatic` will look up your default attached multi-factor device, but you can specify a specific ARN.
+
+More options are available in the application help.
+Use `> aws-assume-role --help ` for help at any time.
+
+Using MFA TOTP with a Yubikey
+-----------------------------
+
+[Yubikeys support TOTP](https://developers.yubico.com/OATH/) this offers some
+benefits over using a phone. One benefit is the TOTP token can be retrieved by
+an API call rather than a user reading the token from the device.
+
+This allows developers to call AWS through aws-assume-role, providing an MFA
+token without prompting for user input. To use this specify
+`--yubikey-oath-name` when calling configure role.
+
+``` sh
+> aws-assume-role configure role -p company-dev --source-profile company_sso  \
+--role-arn=arn:aws:iam::000000000001:role/ViewEC2 --role-session-name=growthsmith \
+--mfa-serial automatic --yubikey-oath-name "Amazon Web Services:myuser@company_sso"
+```
+
+_Yubikey Support_: `aws-assume-role` uses the [smartcard gem](https://rubygems.org/gems/smartcard)
+to connect to the Yubikey, this itself depends upon some C libraries being installed. They provide
+[platform specific instructions](https://github.com/costan/smartcard/blob/master/BUILD#L19)
+for installing these libraries PC/SC.
+
+Testing a profile
+-----------------
+You can test a profile using
+```sh
+> aws-assume-role test -p company_sso
+Logged in as:
+    User: 9999999999
+    Account: arn:aws:iam::3333333333:user/username
+    ARN: AIDAIOSWINGTB
+
+```
+
+Running applications
+--------------------
+
+You can run another application using
+
+``` sh
+aws-assume-role run -p company-dev -- aws ec2 describe-instances --query \
+"Reservations[*].Instances[*].PrivateIpAddress" --output=text
+10.254.4.20
+10.254.4.15
+10.254.0.10
+10.254.4.5
+```
+
+Because we've enabled MFA, aws-assume-role will ask for your MFA token:
+```
+Please provide an MFA token
+000000
+```
+
+Listing available profiles
+--------------------------
+Configured profiles can be listed:
+```sh
+> aws-assume-role list
+company_sso
+company2_sso
+company3_sso
+```
+
+Deleting a profile
+------------------
+If a set of credentials key needs revoking, or the profile isn't relevant anymore:
+``` sh
+> aws-assume-role delete -p company_sso
+Please type the name of the profile, i.e. company_sso , to continue deletion.
+company_sso
+Profile company_sso deleted
+```
+
+Migrating AWS CLI profiles
+------------------
+It's better to revoke the existing keys and generate new ones. We try to overwrite the plaintext configuration
+file with random data, but this does not take care of ~/.aws/credentials and does not account for SSD wear
+levelling or copy-on-write snapshots.
+```
+aws-assume-role migrate -p company_sso
+Profile 'company_sso' migrated to keyring.
+```
+
+Exporting environment variables
+-------------------------------
+You can use a session token in your shell any supported application without using
+`aws-assume-role`.
+
+You can also remove environment variables after finishing using the reset command.
+
+#### Bourne Shell and friends
+``` sh
+>  eval `./bin/aws-assume-role environment set -p company-dev`
+>  eval `./bin/aws-assume-role environment reset`
+```
+
+#### fish
+``` fish
+> set creds (bin/aws-assume-role environment set -s fish -p company-dev); eval $creds; set -e creds
+> set creds (bin/aws-assume-role environment reset -s fish); eval $creds; set -e creds
+```
+
+#### PowerShell
+``` powershell
+> aws-assume-role environment set -s powershell -p company-dev | invoke-expression
+> aws-assume-role environment reset -s powershell | invoke-expression
+```
+
+Launch the AWS console
+---------------------
+Given that `aws-assume-role` has knowledge of your role ARNs via AWS CLI profiles, you can
+get to the AWS console for that role/account using
+
+``` sh
+> aws-assume-role console -p company_sso
+```
+
+`aws-assume-role` will first attempt to log in and get a federated UI link, and
+otherwise fall back to the "switch role" page.
+
+Using inside Ruby
+-----------------
+To get a set of credentials via the OS credential store, or using console-based MFA, use
+the following:
+```
+require "aws_assume_role"
+
+AwsAssumeRole::DefaultProvider.new(options).resolve
+```
+where options is a hash with the following symbol keys:
+*   `access_key_id`
+*   `secret_access_key`
+*   `session_token`
+*   `persist_session`
+*   `duration_seconds`
+*   `role_arn`
+*   `role_session_name`
+*   `serial_number`
+*   `source_profile`
+*   `region`
+
+`aws_assume_role` resolves credentials in almost the same way as the AWS SDK, i.e.:
+
+```no-highlight
+static credentials ⟶ environment variables ⟶ configured profiles role ⟶ assumption (look up source profile and check for 2FA)
+```
+
+Any of the above may get chained to do MFA or role assumption, or both,
+in the following order:
+
+```no-highlight
+second factor ⟶  ecs/instance profile
+```
+
+These are the same as the AWS SDK equivalents whereever possible. The command line help will give an explanation of the rest.
+
+### Monkeypatching the AWS SDK
+You can also override the standard AWS SDK credential resolution system by including the following:
+```
+require "aws_assume_role/core_ext/aws-sdk/credential_provider_chain"
+```
+
+Using any standard AWS SDK for Ruby v2 client will then use aws_assume_role for credential resolution.
+
+
+Please do not use this in production systems.
+
+Other keyring backends
+----------------------
+`aws-assume-role` uses the Keyring gem for secure secret storage. By default, this will use OS X keycain
+or GNOME Keyring. To load alternatives, set the following environment variables:
+
+*   `AWS_ASSUME_ROLE_KEYRING_BACKEND`: Which backend to use, as the name of the Ruby class.
+*   `AWS_ASSUME_ROLE_KEYRING_PLUGIN` : Name of a gem to load.
+
+These are also available in Ruby as the `AwsAssumeRole.Config.backend_plugin` and
+`AwsAssumeRole.Config.backend_plugin` attributes.
+
+
+Development
+-----------
+
+Tests are conducted by Travis.
+
+You can run these locally using Rake:
+
+```shell
+bundle exec rake test
+```
+
+License
+-------
+
+This library and program is distributed under the
+[Apache License, version 2.0](http://www.apache.org/licenses/LICENSE-2.0.html)
+
+```no-highlight
+Copyright 2017. The Scale Factory Ltd. All Rights Reserved.
+Portions Copyright 2013. Amazon Web Services, Inc. All Rights Reserved.
+
+licensed under the apache license, version 2.0 (the "license");
+you may not use this file except in compliance with the license.
+you may obtain a copy of the license at
+
+    http://www.apache.org/licenses/license-2.0
+
+unless required by applicable law or agreed to in writing, software
+distributed under the license is distributed on an "as is" basis,
+without warranties or conditions of any kind, either express or implied.
+see the license for the specific language governing permissions and
+limitations under the license.

data/Rakefile

@@ -0,0 +1,63 @@
+# frozen_string_literal: true
+
+require "aws_assume_role/version"
+require "bundler/gem_tasks"
+require "yaml"
+
+task default: :test
+
+begin
+    require "rspec/core/rake_task"
+    RSpec::Core::RakeTask.new(:spec)
+rescue LoadError # rubocop:disable Lint/HandleExceptions
+end
+
+begin
+    require "rubocop/rake_task"
+    RuboCop::RakeTask.new(:rubocop)
+rescue LoadError # rubocop:disable Lint/HandleExceptions
+end
+
+task test: %i[no_pry rubocop spec]
+
+DISTRIBUTIONS = [
+    "universal-linux",
+    "universal-freebsd",
+    "universal-darwin",
+    "universal-openbsd",
+].freeze
+
+CREDENTIALS = {
+    rubygems_api_key: ENV.fetch("API_KEY", "null"),
+}.freeze
+
+task :setup_credentials do
+    FileUtils.mkdir_p(File.expand_path("~/.gem"))
+    File.write(File.expand_path("~/.gem/credentials"), CREDENTIALS.to_yaml)
+end
+
+task publish: [:build] do
+    Dir.glob("#{File.dirname(__FILE__)}/pkg/*.gem") do |g|
+        sh "gem push #{g}"
+    end
+end
+
+namespace :build_arch do
+    DISTRIBUTIONS.each do |arch|
+        desc "build binary gem for #{arch}"
+        task arch do
+            sh "cd #{File.dirname(__FILE__)} && PLATFORM=#{arch} gem build aws_assume_role.gemspec"
+            FileUtils.mkdir_p(File.join(File.dirname(__FILE__), "pkg"))
+            sh "cd #{File.dirname(__FILE__)} && mv *.gem pkg/"
+        end
+    end
+end
+
+task build: DISTRIBUTIONS.map { |d| "build_arch:#{d}" }
+
+task :no_pry do
+    files = Dir.glob("**/**").reject { |x| x.match(/^spec|Gemfile|coverage|\.gemspec$|Rakefile/) || File.directory?(x) }
+    files.each do |file|
+        raise "Use of pry found in #{file}." if File.read(file) =~ /"pry"/
+    end
+end

data/aws_assume_role.gemspec

@@ -0,0 +1,56 @@
+# frozen_string_literal: true
+
+$LOAD_PATH << File.expand_path("../lib", __FILE__)
+require "aws_assume_role/version"
+
+PLATFORM = ENV.fetch("PLATFORM", Gem::Platform.local.os)
+
+Gem::Specification.new do |spec|
+    spec.name          = "aws_assume_role"
+    spec.version       = AwsAssumeRole::VERSION
+    spec.authors       = ["Jon Topper", "Jack Thomas", "Naadir Jeewa", "David King", "Tim Bannister", "Phil Potter", "Tom Haynes"]
+    spec.email         = ["jon@scalefactory.com", "jack@scalefactory.com", "naadir@scalefactory.com", "tim@scalefactory.com"]
+
+    spec.description   = "Used to fetch multiple AWS Role Credential "\
+                         "Keys using different Session Keys "\
+                         "and store them securely using Gnome Keyring "\
+                         "or OSX keychain"
+    spec.summary       = "Manage AWS STS credentials with MFA"
+    spec.homepage      = "https://github.com/scalefactory/aws-assume-role"
+    spec.license       = "Apache-2.0"
+
+    spec.files         = `git ls-files -z`.split("\x0").reject { |f|
+        f.match(%r{^(test|spec|features)/})
+    }
+    spec.bindir        = "bin"
+    spec.executables   = spec.files.grep(%r{^bin/aws}) { |f| File.basename(f) }
+    spec.require_paths = ["lib"]
+    spec.platform      = PLATFORM
+    spec.add_runtime_dependency "activesupport", "~> 4.2"
+    spec.add_runtime_dependency "aws-sdk", "~> 2.7"
+    spec.add_runtime_dependency "dry-configurable", "~> 0.5"
+    spec.add_runtime_dependency "dry-struct", "~> 0.1"
+    spec.add_runtime_dependency "dry-types", "~> 0.12"
+    spec.add_runtime_dependency "dry-validation", "~> 0.10"
+    spec.add_runtime_dependency "gli", "~> 2.15"
+    spec.add_runtime_dependency "highline", "~> 1.6"
+    spec.add_runtime_dependency "i18n", "~> 0.7"
+    spec.add_runtime_dependency "inifile", "~> 3.0"
+    spec.add_runtime_dependency "launchy", "~> 2.4"
+    spec.add_runtime_dependency "keyring", "~> 0.4", ">= 0.4.1"
+    spec.add_runtime_dependency "pastel", "~> 0.7"
+    spec.add_runtime_dependency "smartcard", "~> 0.5.6"
+    spec.add_runtime_dependency "yubioath", "~> 1.2", ">= 1.2.1"
+    spec.add_development_dependency "rspec", "~> 3.5"
+    spec.add_development_dependency "rubocop", "0.50"
+    spec.add_development_dependency "yard", "~> 0.9"
+    spec.add_development_dependency "simplecov", "~> 0.13"
+    spec.add_development_dependency "webmock", "~> 2.3"
+
+    case PLATFORM
+    when /linux|bsd/
+        spec.add_dependency "gir_ffi-gnome_keyring", "~> 0.0", ">= 0.0.3"
+    when /darwin/
+        spec.add_dependency "ruby-keychain", "~> 0.3", ">= 0.3.2"
+    end
+end

data/bin/aws-assume-role

@@ -0,0 +1,4 @@
+#!/usr/bin/env ruby
+# frozen_string_literal: true
+
+require_relative "../lib/aws_assume_role/cli"

data/i18n/en.yml

@@ -0,0 +1,109 @@
+en:
+    commands:
+        configure:
+            desc: Configure AWS
+            long_desc: |
+                Configure  AWS  profiles. If this command is run with no arguments,
+                you will be prompted for configuration values such as your  AWS  Access
+                Key  Id  and you AWS Secret Access Key.  You can configure a named pro-
+                file using the --profile argument.  If your config file does not  exist
+                (the default location is ~/.aws/config), the AWS CLI will create it for
+                you.  To keep an existing value, hit enter when prompted for the value.
+                When  you  are prompted for information, the current value will be dis-
+                played in [brackets].  If the config item has no value, it be displayed
+                as  [None].  Note that the configure command only work with values from
+                the config file.  It does not use any configuration values  from  envi-
+                ronment variables or the IAM role.
+
+                Note:  The  values  you  provide  for the AWS Access Key ID and the AWS
+                Secret Access Key will be written to your keyring backend.
+            saved: Profile %s saved to %s
+        console:
+            desc: Launch the AWS console to switch to the profile role.
+            long_desc: |
+                Looks up the Role ARN in the profile, constructs the AWS console
+                URL and launches your browser with it. It's a convenience, doesn't
+                use any of the credentials.
+        set_environment:
+            desc: Export assumed credentials to your shell environment.
+            long_desc: |
+                Set up environment variables in your shell so that you can run AWS CLI
+                or other apps using those credentials without running aws-assume-role
+                again.
+                Supports Bourne, CSh, Fish and PowerShell.
+            shells:
+                powershell: Use `aws-assume-role environment set -s powershell -p <profile_name> | Invoke-Expression` to load into environment
+                others: Use `eval aws-assume-role environment set -p <profile_name>` to load into environment
+                fish: Use `set creds (bin/aws-assume-role environment set -s fish); eval $creds; set -e creds`
+        reset_environment:
+            desc: Delete AWS environment variables.
+            long_desc: |
+                Cleans up your shell environment by removing the following environment variables:
+                    AWS_ACCESS_KEY_ID
+                    AWS_SECRET_ACCESS_KEY
+                    AWS_DEFAULT_REGION
+                    AWS_PROFILE
+                    AWS_ASSUME_ROLE_LOG_LEVEL
+                    GLI_DEBUG
+                Supports Bourne, CSh, Fish and PowerShell.
+            shells:
+                powershell: Use `aws-assume-role environment reset -s powershell -p <profile_name> | Invoke-Expression` to load into environment
+                others: Use `eval aws-assume-role environment reset -p <profile_name>` to load into environment
+                fish: Use `set creds (bin/aws-assume-role environment reset -s fish); eval $creds; set -e creds`
+        run:
+            desc: Run a program with credentials set in the environment.
+        delete:
+            desc: Delete a profile
+            completed: "Profile %s deleted"
+            not_found: "Cannot find profile %s. Try running `aws-assume-role list`"
+        list:
+            desc: List configured profiles
+        migrate:
+            desc: Migrate a store to secure storage.
+            not_found: "Cannot find profile %s. Try running `aws-assume-role list`"
+            saved: Profile %s migrated within %s
+        test:
+            desc: Check that credentials work
+            output: |
+                Logged in as:
+                    User: %s
+                    Account: %s
+                    ARN: %s
+    options:
+        aws_access_key_id: "Enter the AWS Access Key ID to use for this profile"
+        aws_secret_access_key: "Enter the AWS Secret Access Key to use for this profile"
+        region: Enter the AWS region you would like to default to
+        profile_name: Enter the profile name to save into configuration
+        mfa_token:
+            first_time: "Please provide an MFA token"
+            other_times: "Credentials have expired, please provide another MFA"
+            smartcard_not_supported: "Smartcard drivers not installed, see https://github.com/scalefactory/aws-assume-role/blob/master/README.md for details" 
+        default_role: "A default role to assume (leave blank to not use)"
+        external_id: String provided by the external account holder to uniquely identify you.
+        source_profile: Which profile to use to assume this role.
+        role_session_name: Name to uniquely identify your session
+        mfa_serial: The identification number of the MFA device. Leave blank to determine dynamically at run time.
+        role_arn: The Amazon Resource Name (ARN) of the role to assume.
+        duration_seconds: Default session length
+        shell_type: What type of shell to use.
+        name_to_delete: Please type the name of the profile, i.e. %s , to continue deletion.
+        yubikey_oath_name: Identifier of the OATH / TOTP secret stored on the yubikey.
+    program_description: "A tool for AWS credential management"
+    errors:
+        NoSuchProfileError: Profile %s not found in shared configuration.
+        SmartcardException:  No YubiKey found!
+        MissingCredentialsError: No credentials found!
+        rules:
+            profile:
+                filled?: --profile must be specified.
+            role-arn:
+                format?: "--role-arn must be specified as an ARN in the format `arn:aws:iam::account-id:role/role-name`"
+                filled?: --role-arn is required.
+            serial-number:
+                format?: "--mfa-serial must be specified as an ARN in the format `arn:aws:iam::account-id:mfa/virtual-device-name`"
+                filled?: --mfa-serial is required.
+            region:
+                format?: "--region must be a valid AWS Standard, China or GovCloud region"
+                filled?: --region is required
+            role_specification:
+                filled?: "Either specify --profile OR (--role-arn AND --role-session-name, or neither)"

data/lib/aws_assume_role/cli/actions/abstract_action.rb

@@ -0,0 +1,61 @@
+# frozen_string_literal: true
+
+require_relative "includes"
+require_relative "../../profile_configuration"
+
+class AwsAssumeRole::Cli::Actions::AbstractAction
+    include AwsAssumeRole
+    include AwsAssumeRole::Types
+    include AwsAssumeRole::Ui
+    include AwsAssumeRole::Logging
+    CommandSchema = proc { raise "CommandSchema Not implemented" }
+
+    def initialize(global_options, options, args)
+        config = ProfileConfiguration.new_from_cli(global_options, options, args)
+        logger.debug "Config initialized with #{config.to_hash}"
+        result = validate_options(config.to_hash)
+        logger.debug "Config validated as #{result.to_hash}"
+        result.success? ? act_on(config) : Ui.show_validation_errors(result)
+    end
+
+    private
+
+    def try_for_credentials(config)
+        @provider ||= AwsAssumeRole::Credentials::Factories::DefaultChainProvider.new(config.to_hash)
+        creds = @provider.resolve(nil_with_role_not_set: true)
+        logger.debug "Got credentials #{creds}"
+        return creds unless creds.nil?
+    rescue Smartcard::PCSC::Exception
+        error t("errors.SmartcardException")
+        exit 403
+    rescue NoMethodError
+        error t("errors.MissingCredentialsError")
+        exit 404
+    end
+
+    def resolved_region
+        @provider.region
+    end
+
+    def resolved_profile
+        @provider.profile
+    end
+
+    def validate_options(options)
+        command_schema = self.class::CommandSchema
+        ::Dry::Validation.Schema do
+            configure { config.messages = :i18n }
+            instance_eval(&command_schema)
+        end.call(options)
+    end
+
+    def prompt_for_option(key, option_name, validator, fmt: nil)
+        text_lookup = t("options.#{key}")
+        text = fmt.nil? ? text_lookup : format(text_lookup, fmt)
+        Ui.ask_with_validation(option_name, text) { instance_eval(&validator) }
+    end
+
+    def act_on(_options)
+        raise "Act On Not Implemented"
+    end
+end

data/lib/aws_assume_role/cli/actions/configure_profile.rb

@@ -0,0 +1,24 @@
+# frozen_string_literal: true
+
+require_relative "abstract_action"
+require_relative "../../store/shared_config_with_keyring"
+
+class AwsAssumeRole::Cli::Actions::ConfigureProfile < AwsAssumeRole::Cli::Actions::AbstractAction
+    CommandSchema = proc do
+        required(:profile)
+        optional(:region) { filled? > format?(REGION_REGEX) }
+        optional(:mfa_serial)
+        optional(:profile_name)
+        optional(:yubikey_oath_name)
+    end
+
+    def act_on(config)
+        new_hash = config.to_h
+        profile = config.profile || prompt_for_option(:profile_name, "profile", proc { filled? })
+        new_hash[:region] = prompt_for_option(:region, "region", proc { filled? > format?(REGION_REGEX) })
+        new_hash[:aws_access_key_id] = prompt_for_option(:aws_access_key_id, "aws_access_key_id", ACCESS_KEY_VALIDATOR)
+        new_hash[:aws_secret_access_key] = prompt_for_option(:aws_secret_access_key, "aws_secret_access_key", proc { filled? })
+        AwsAssumeRole.shared_config.save_profile(profile, new_hash)
+        out format(t("commands.configure.saved"), profile, AwsAssumeRole.shared_config.config_path)
+    end
+end

data/lib/aws_assume_role/cli/actions/configure_role_assumption.rb

@@ -0,0 +1,22 @@
+# frozen_string_literal: true
+
+require_relative "abstract_action"
+
+class AwsAssumeRole::Cli::Actions::ConfigureRoleAssumption < AwsAssumeRole::Cli::Actions::AbstractAction
+    CommandSchema = proc do
+        required(:profile)
+        required(:source_profile) { str? }
+        optional(:region) { filled? > format?(REGION_REGEX) }
+        optional(:serial_number) { filled? > format?(MFA_REGEX) }
+        required(:role_session_name).filled?
+        required(:role_arn) { filled? & format?(ROLE_REGEX) }
+        required(:external_id).filled?
+        required(:duration_seconds).filled?
+        optional(:yubikey_oath_name)
+    end
+
+    def act_on(config)
+        AwsAssumeRole.shared_config.save_profile(config.profile, config.to_h.compact)
+        out format(t("commands.configure.saved"), config.profile, AwsAssumeRole.shared_config.config_path)
+    end
+end