switch-profile 0.0.9 → 0.1.2

package/CHANGELOG.md

@@ -2,6 +2,27 @@
 
 All notable changes to this project will be documented in this file. See [standard-version](https://github.com/conventional-changelog/standard-version) for commit guidelines.
 
+### [0.1.2](https://github.com/nicolasdao/switch-profile/compare/v0.1.1...v0.1.2) (2022-05-14)
+
+
+### Bug Fixes
+
+* Multiple SSO profiles are not supported. It only uses one. ([b9d9d03](https://github.com/nicolasdao/switch-profile/commit/b9d9d03b4edfa048cc157376222378513138e257))
+
+### [0.1.1](https://github.com/nicolasdao/switch-profile/compare/v0.1.0...v0.1.1) (2021-08-03)
+
+
+### Bug Fixes
+
+* Edge cases where the SSO session expires and a forde login is required ([67f3667](https://github.com/nicolasdao/switch-profile/commit/67f36678f29f2ab5f02c4d4630eb1c7c41ccebbf))
+
+## [0.1.0](https://github.com/nicolasdao/switch-profile/compare/v0.0.9...v0.1.0) (2021-08-03)
+
+
+### Bug Fixes
+
+* Switching to an SSO profile adds an incorrect 'sso_' prefix to the default region in ~/.aws/config file ([384c17e](https://github.com/nicolasdao/switch-profile/commit/384c17e26b368754a5bfdb5ca47fd9996181f3b7))
+
 ### [0.0.9](https://github.com/nicolasdao/switch-profile/compare/v0.0.8...v0.0.9) (2021-07-19)
 
 

package/README.md

@@ -15,7 +15,26 @@ This utility also supports creating new AWS profiles, including SSO profiles as
 >	- `AWS_SECRET_ACCESS_KEY`
 >	- `AWS_SESSION_TOKEN`
 
-# Why using this utility?
+# Table of contents
+
+> * [Extra features](#extra-features)
+> * [FAQ](#faq)
+>	- [Why using this utility?](#why-using-this-utility)
+>	- [How to create a new SSO profile?](#how-to-create-a-new-sso-profile)
+> * [Troubleshooting](#troubleshooting)
+>	- [`invalid_grant: Invalid grant provided`](#invalid_grant-invalid-grant-provided)
+>	- [`Error: Fail to get credentials for profile ... Error loading SSO Token...`](#error-fail-to-get-credentials-for-profile--error-loading-sso-token)
+> * [License](#license)
+
+# Extra features
+
+The `More options` supports the following:
+- `Create profile`: Helps create both a standard or AWS SSO profile.
+- `Delete profiles`: Helps cleaning one or many profiles.
+- `Refresh default profile`: Helps refreshing the current default profile if it has expired (e.g., SSO profile). This option only appears when the default profile has expired.
+
+# FAQ
+## Why using this utility?
 
 `switch-profile` was originally created to refresh short-lived AWS SSO profiles in the terminal and set them as default. Indeed, as of 2021, the only two ways to set up a short-lived SSO profile as default in the terminal are:
 - Manually paste the short-lived credentials in the terminal:
@@ -31,12 +50,22 @@ The issue with the first method is that you have to repeat it every hour, which
 
 `switch-profile` aims to solve those issues by making setting any profile as `default` trivial. 
 
-# Extra features
+## How to create a new SSO profile?
 
-The `More options` supports the following:
-- `Create profile`: Helps create both a standard or AWS SSO profile.
-- `Delete profiles`: Helps cleaning one or many profiles.
-- `Refresh default profile`: Helps refreshing the current default profile if it has expired (e.g., SSO profile). This option only appears when the default profile has expired.
+1. `npx switch-profile`
+2. Select `More options`, then `Create profile`.
+3. Answer all the questions.
+
+# Troubleshooting
+## `invalid_grant: Invalid grant provided`
+
+If this error occurs during a [profile creation step](#how-to-create-a-new-sso-profile), this is most likely due to an incorrect SSO region. AWS SSO is region specific. This error occurs if an incorrect region is specified during the [profile creation step](#how-to-create-a-new-sso-profile).
+
+## `Error: Fail to get credentials for profile ... Error loading SSO Token...`
+
+This is probably due to a recent deletion of the `~/.aws/sso/cache` folder. This folder keeps track of the SSO profiles created on the local machine. Unfortunately in this case, there is no other option but to recreate all the SSO profiles manually:
+1. Execute `npx switch-profile`
+2. Select `More options`, then `Delete profiles`.
 
 # License
 

package/index.js

@@ -310,6 +310,7 @@ const setProfileToDefault = async (profileName, profileList, successMsg) => {
 	if (credsErrors)
 		return printAWSerrors([new Error(`Fail to get credentials for profile ${profile.name}`), ...credsErrors])
 
+	// console.log(profile)
 	// console.log(creds)
 
 	const [errors] = await updateDefaultProfile({

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "switch-profile",
-  "version": "0.0.9",
+  "version": "0.1.2",
   "main": "index.js",
   "bin": "index.js",
   "description": "NPX script that exposes terminal shortcut to easily switch between cloud configuration (aws, gcp).",

package/src/aws/index.js

@@ -7,10 +7,10 @@ const fileHelper = require('../fileHelper')
 const regions = require('./regions')
 
 const SSO_GET_CREDS_TIMEOUT = 5*60*1000 // 5 minutes to complete the SSO login
-const AWS_CONFIG_FILE = join(homedir(), '.aws/config')
-const AWS_CREDS_FILE = join(homedir(), '.aws/credentials')
-const AWS_SSO_FOLDER = join(homedir(), '.aws/sso/cache/')
-const AWS_CLI_FOLDER = join(homedir(), '.aws/cli/cache/')
+const AWS_CONFIG_FILE = join(homedir(), '.aws', 'config')
+const AWS_CREDS_FILE = join(homedir(), '.aws', 'credentials')
+const AWS_SSO_FOLDER = join(homedir(), '.aws', 'sso', 'cache')
+const AWS_CLI_FOLDER = join(homedir(), '.aws', 'cli', 'cache')
 const DEFAULT_CONFIG = 
 `[default]
 region = ap-southeast-1
@@ -33,15 +33,19 @@ const awsCliV2Exists = noFailIfMissing => catchErrors((async () => {
 		throw wrapErrors('AWS CLI error', awsCliErrors)
 	}
 
-	const data = await exec('aws --version') || ''
-	const [majorVersion] = ((data.match(/aws-cli\/(.*?)\s/g)||[])[0]||'').replace('aws-cli/','').split('.')
-	const version = majorVersion*1
-	if (isNaN(version))
-		throw new Error('Fail to test the AWS CLI version. Please try to run "aws --version" manually to try to debug this issue.')
-	if (version <= 1)
-		throw new Error(`AWS CLI version ${version} is not supported. Please upgrade to AWS CLI v2 or greater.`)
-
-	return true
+	try {
+		const data = await exec('aws --version') || ''
+		const [majorVersion] = ((data.match(/aws-cli\/(.*?)\s/g)||[])[0]||'').replace('aws-cli/','').split('.')
+		const version = majorVersion*1
+		if (isNaN(version))
+			throw new Error('Fail to test the AWS CLI version. Please try to run "aws --version" manually to try to debug this issue.')
+		if (version <= 1)
+			throw new Error(`AWS CLI version ${version} is not supported. Please upgrade to AWS CLI v2 or greater.`)
+
+		return true
+	} catch(err) {
+		throw wrapErrors('Fail to check AWS CLI\'s version', [err])
+	}
 })())
 
 const getParam = (params, paramName) => {
@@ -107,6 +111,9 @@ const listProfiles = () => catchErrors((async () => {
 			output: getParam(params, 'output')
 		}
 
+		if (p.sso_region)
+			p.region = p.sso_region
+
 		p.friendlyName = `${p.name}${p.sso_start_url ? ` (SSO [role:${p.sso_role_name||'unknown'} - account:${p.sso_account_id||'unknown'}])` : ''}`
 
 		return p 
@@ -182,14 +189,15 @@ const getSsoCredsFromCacheFile = (access_key_end, secret_key_end) => catchErrors
 
 	for (let i=0;i<files.length;i++) {
 		const _creds = await fileHelper.json.get(files[i])
+
 		// Creds must be SSO
 		if (!_creds || _creds.ProviderType != 'sso' || !_creds.Credentials)
 			continue
 
 		// Creds must still be valid for the next 2 minutes
 		if (_creds.Credentials.Expiration && (Date.now() - 2*60*1000) < new Date(_creds.Credentials.Expiration).getTime()) {
-			const credsMatch = _creds.Credentials.AccessKeyId||''.slice(-4) == access_key_end && 
-				_creds.Credentials.SecretAccessKey||''.slice(-4) == secret_key_end
+			const credsMatch = (_creds.Credentials.AccessKeyId||'').slice(-4) == access_key_end && 
+				(_creds.Credentials.SecretAccessKey||'').slice(-4) == secret_key_end
 
 			if (credsMatch)
 				return {
@@ -220,27 +228,40 @@ const getSsoCredsFromCacheFile = (access_key_end, secret_key_end) => catchErrors
 const getSsoCredentials = profile => catchErrors((async () => {
 	await awsCliV2Exists()
 	const errMsg = `Fail to get AWS SSO credentials for profile ${profile}`
-	if (!profile)
-		throw wrapErrors(errMsg, [new Error('Missing required \'profile\' argument')])
-	const data = await exec(`aws configure list --profile ${profile}`) || ''
-	const access_key_end = ((data.match(/access_key\s*\*+.{4}/g)||[])[0]||'').slice(-4)
-	const secret_key_end = ((data.match(/secret_key\s*\*+.{4}/g)||[])[0]||'').slice(-4)
-
-	if (!access_key_end || !secret_key_end)
-		return null 
-
-	const [ssoCredsErrors, creds] = await getSsoCredsFromCacheFile(access_key_end, secret_key_end)
-	if (ssoCredsErrors)
-		throw wrapErrors(errMsg, ssoCredsErrors)
-	return creds
+	try {
+		if (!profile)
+			throw wrapErrors(errMsg, [new Error('Missing required \'profile\' argument')])
+		const data = await exec(`aws configure list --profile ${profile}`) || ''
+		const access_key_end = ((data.match(/access_key\s*\*+.{4}/g)||[])[0]||'').slice(-4)
+		const secret_key_end = ((data.match(/secret_key\s*\*+.{4}/g)||[])[0]||'').slice(-4)
+
+		if (!access_key_end || !secret_key_end)
+			return null 
+
+		const [ssoCredsErrors, creds] = await getSsoCredsFromCacheFile(access_key_end, secret_key_end)
+
+		if (ssoCredsErrors)
+			throw wrapErrors(errMsg, ssoCredsErrors)
+		return creds
+	} catch(err) {
+		throw wrapErrors(errMsg, [err])
+	}
 })())
 
+const isSSOexpired = ssoSession => {
+	if (!ssoSession)
+		return true
+
+	return (new Date(ssoSession.expiresAt).getTime() - Date.now()) < (2*60*1000)
+}
+
 /**
  * Makes sure the profile is using a valid (i.e., exists and not expired) local SSO session. If not, try 
  * to create one manually by redirecting the user to the SSO page. 
  * 
- * @param  {String} profile		e.g., 'sso-dev-cloudless'
- * @param  {String} ssoUrl 		e.g., 'https://cloudless.awsapps.com/start'
+ * @param  {String}  profile			e.g., 'sso-dev-cloudless'
+ * @param  {String}  ssoUrl 			e.g., 'https://cloudless.awsapps.com/start'
+ * @param  {Boolean} options.force		
  * 
  * @return {[Error]} 
  * @return {String} session.aws_access_key_id		e.g., '********1234'
@@ -248,32 +269,38 @@ const getSsoCredentials = profile => catchErrors((async () => {
  * @return {String} session.aws_session_token		e.g., 'dwqdwdwqd...dwqdqw'
  * @return {Date}   session.expiry_date				e.g., 2021-07-17T11:33:12Z
  */
-const refreshSsoSession = (profile, ssoUrl) => catchErrors((async () => {
+const refreshSsoSession = (profile, ssoUrl, options) => catchErrors((async () => {
 	const errMsg = `Fail to refresh the SSO session for AWS profile ${profile}`
 	let [ssoSessionErrors, ssoSession] = await getSsoSession(ssoUrl)
 	if (ssoSessionErrors)
 		throw wrapErrors(errMsg, ssoSessionErrors)
 
-	// No valid SSO session found. Manually get a new one via the SSO portal
-	const startTime = Date.now()
-	if (!ssoSession) {
-		await exec(`aws sso login --profile ${profile}`)
-		while (!ssoSession && Date.now() - startTime < SSO_GET_CREDS_TIMEOUT) {
-			const resp = await getSsoSession(ssoUrl)
-			if (resp[0])
-				throw wrapErrors(errMsg, resp[0])
-			ssoSession = resp[1]
-			if (!ssoSession)
-				await delay(2000)
+	const { force } = options || {}
+
+	try {
+		// No valid SSO session found. Manually get a new one via the SSO portal
+		const startTime = Date.now()
+		if (force || isSSOexpired(ssoSession)) {
+			await exec(`aws sso login --profile ${profile}`)
+			while (!ssoSession && Date.now() - startTime < SSO_GET_CREDS_TIMEOUT) {
+				const resp = await getSsoSession(ssoUrl)
+				if (resp[0])
+					throw wrapErrors(errMsg, resp[0])
+				ssoSession = resp[1]
+				if (!ssoSession)
+					await delay(2000)
+			}
 		}
-	}
 
-	if (ssoSession)
-		return ssoSession 
-	else if (Date.now() - startTime > SSO_GET_CREDS_TIMEOUT)
-		throw wrapErrors(errMsg, [new Error(`Timeout - Time to wait for refreshing the SSO session for profile ${profile} exceeded ${SSO_GET_CREDS_TIMEOUT}ms.`)])
-	else
-		return null
+		if (ssoSession)
+			return ssoSession 
+		else if (Date.now() - startTime > SSO_GET_CREDS_TIMEOUT)
+			throw wrapErrors(errMsg, [new Error(`Timeout - Time to wait for refreshing the SSO session for profile ${profile} exceeded ${SSO_GET_CREDS_TIMEOUT}ms.`)])
+		else
+			return null
+	} catch(err) {
+		throw wrapErrors(errMsg, [err])
+	}
 })())
 
 /**
@@ -296,9 +323,19 @@ const getCredentials = (profile, ssoUrl) => catchErrors((async () => {
 	const errMsg = `Fail to get AWS credentials for profile ${profile}`
 	if (ssoUrl) {
 		await refreshSsoSession(profile, ssoUrl)
-		const [ssoCredsErrors, ssoCreds] = await getSsoCredentials(profile)
-		if (ssoCredsErrors)
-			throw wrapErrors(errMsg, ssoCredsErrors)
+		let [ssoCredsErrors, ssoCreds] = await getSsoCredentials(profile)
+		if (ssoCredsErrors) {
+			const ssoSessionIsInvalid = ssoCredsErrors.some(e => e.message && e.message.toLowerCase().indexOf('session associated with this profile has expired') >= 0)
+			if (ssoSessionIsInvalid) {
+				await refreshSsoSession(profile, ssoUrl, { force:true })
+				const resp = await getSsoCredentials(profile)
+				if (resp[0])
+					throw wrapErrors(errMsg, resp[0])
+
+				ssoCreds = resp[1]
+			} else
+				throw wrapErrors(errMsg, ssoCredsErrors)
+		}
 
 		return ssoCreds
 	} else {