aws-ssh-utils 0.1.0__tar.gz → 0.2.0__tar.gz

aws_ssh_utils-0.2.0/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2025 mvanderlee
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

aws_ssh_utils-0.2.0/PKG-INFO

@@ -0,0 +1,117 @@
+Metadata-Version: 2.4
+Name: aws-ssh-utils
+Version: 0.2.0
+Summary: Easy AWS SSHing
+Project-URL: Homepage, https://github.com/mvanderlee/aws-ssh-utils
+Author-email: Michiel Vanderlee <jmt.vanderlee@gmail.com>
+License-Expression: MIT
+License-File: LICENSE
+Classifier: Intended Audience :: Developers
+Classifier: Intended Audience :: Information Technology
+Classifier: Intended Audience :: System Administrators
+Classifier: License :: OSI Approved :: MIT License
+Classifier: Operating System :: OS Independent
+Classifier: Programming Language :: Python
+Classifier: Programming Language :: Python :: 3 :: Only
+Classifier: Programming Language :: Python :: 3.11
+Classifier: Programming Language :: Python :: 3.12
+Classifier: Programming Language :: Python :: 3.13
+Classifier: Topic :: Software Development
+Classifier: Topic :: Software Development :: Libraries
+Classifier: Topic :: Software Development :: Libraries :: Python Modules
+Classifier: Typing :: Typed
+Requires-Python: >=3.11
+Requires-Dist: boto3
+Requires-Dist: click
+Requires-Dist: click-spinner
+Requires-Dist: coloredlogs
+Requires-Dist: environs
+Requires-Dist: loguru
+Requires-Dist: paramiko
+Requires-Dist: questionary
+Provides-Extra: dev
+Requires-Dist: boto3-stubs[ec2,emr]; extra == 'dev'
+Provides-Extra: publish
+Requires-Dist: hatch>=1.7.0; extra == 'publish'
+Provides-Extra: test
+Description-Content-Type: text/markdown
+
+# AWS SSH Utils
+
+[![Version](https://img.shields.io/pypi/v/aws-ssh-utils.svg)](https://pypi.org/project/aws-ssh-utils/)
+[![License](https://img.shields.io/pypi/l/aws-ssh-utils.svg)](#)
+[![Supported Python Versions](https://img.shields.io/pypi/pyversions/aws-ssh-utils.svg)](https://pypi.org/project/aws-ssh-utils/)
+
+```shell
+pip install aws-ssh-utils
+
+aws_ssh ec2
+
+aws_ssh emr
+
+aws_ssh emr-all
+```
+
+This allows you to interactively SSH to an EC2 instance, EMR instance, or all EMR instances with TMUX.
+
+It utilizes [questionary](https://pypi.org/project/questionary/) to ask you which instance you want to connect to.
+
+## EC2
+
+Select an instance from an interactive list. You can filter the instances by name.
+
+```shell
+$ aws_auth ec2 --help
+Usage: aws_ssh ec2 [OPTIONS]
+
+  Asks user which EC2 instance they want to connect to, then opens an
+  interactive SSH session to the instance
+
+Options:
+  -p, --profile TEXT    Which AWS profile to use
+  -r, --region TEXT     Which AWS region to use
+  -u, --user TEXT       Which user to connect as
+  --private / --public  Connect to the instance's private or public IP
+  -k, --key-file TEXT   Which key file to use to connect
+  --help                Show this message and exit.
+```
+
+## EMR
+
+Select the EMR cluster, instance group, and instance to connect to.
+
+```shell
+$ aws_ssh emr --help
+Usage: aws_ssh emr [OPTIONS]
+
+  Asks user which Cluster and EC2 instance they want to connect to, then opens an interactive SSH session to the instance
+
+Options:
+  -p, --profile TEXT    Which AWS profile to use
+  -r, --region TEXT     Which AWS region to use
+  -u, --user TEXT       Which user to connect as
+  --private / --public  Connect to the instance's private or public IP
+  -k, --key-file TEXT   Which key file to use to connect
+  --help                Show this message and exit.
+```
+
+## EMR All
+
+Select the EMR cluster to connect to. Then creates a new TMUX session with a window per instance. Each window will have an SSH connection to that instance open.
+
+```shell
+$ aws_ssh emr-all --help
+Usage: aws_ssh emr-all [OPTIONS]
+
+  Asks user which Cluster and EC2 instance they want to connect to, Then
+  prints a tmux cli statement that will open a new session with a window per
+  ec2 instance with ssh shell already opened.
+
+Options:
+  -p, --profile TEXT    Which AWS profile to use
+  -r, --region TEXT     Which AWS region to use
+  -u, --user TEXT       Which user to connect as
+  --private / --public  Connect to the instance's private or public IP
+  -k, --key-file TEXT   Which key file to use to connect
+  --help                Show this message and exit.
+```

aws_ssh_utils-0.2.0/README.md

@@ -0,0 +1,79 @@
+# AWS SSH Utils
+
+[![Version](https://img.shields.io/pypi/v/aws-ssh-utils.svg)](https://pypi.org/project/aws-ssh-utils/)
+[![License](https://img.shields.io/pypi/l/aws-ssh-utils.svg)](#)
+[![Supported Python Versions](https://img.shields.io/pypi/pyversions/aws-ssh-utils.svg)](https://pypi.org/project/aws-ssh-utils/)
+
+```shell
+pip install aws-ssh-utils
+
+aws_ssh ec2
+
+aws_ssh emr
+
+aws_ssh emr-all
+```
+
+This allows you to interactively SSH to an EC2 instance, EMR instance, or all EMR instances with TMUX.
+
+It utilizes [questionary](https://pypi.org/project/questionary/) to ask you which instance you want to connect to.
+
+## EC2
+
+Select an instance from an interactive list. You can filter the instances by name.
+
+```shell
+$ aws_auth ec2 --help
+Usage: aws_ssh ec2 [OPTIONS]
+
+  Asks user which EC2 instance they want to connect to, then opens an
+  interactive SSH session to the instance
+
+Options:
+  -p, --profile TEXT    Which AWS profile to use
+  -r, --region TEXT     Which AWS region to use
+  -u, --user TEXT       Which user to connect as
+  --private / --public  Connect to the instance's private or public IP
+  -k, --key-file TEXT   Which key file to use to connect
+  --help                Show this message and exit.
+```
+
+## EMR
+
+Select the EMR cluster, instance group, and instance to connect to.
+
+```shell
+$ aws_ssh emr --help
+Usage: aws_ssh emr [OPTIONS]
+
+  Asks user which Cluster and EC2 instance they want to connect to, then opens an interactive SSH session to the instance
+
+Options:
+  -p, --profile TEXT    Which AWS profile to use
+  -r, --region TEXT     Which AWS region to use
+  -u, --user TEXT       Which user to connect as
+  --private / --public  Connect to the instance's private or public IP
+  -k, --key-file TEXT   Which key file to use to connect
+  --help                Show this message and exit.
+```
+
+## EMR All
+
+Select the EMR cluster to connect to. Then creates a new TMUX session with a window per instance. Each window will have an SSH connection to that instance open.
+
+```shell
+$ aws_ssh emr-all --help
+Usage: aws_ssh emr-all [OPTIONS]
+
+  Asks user which Cluster and EC2 instance they want to connect to, Then
+  prints a tmux cli statement that will open a new session with a window per
+  ec2 instance with ssh shell already opened.
+
+Options:
+  -p, --profile TEXT    Which AWS profile to use
+  -r, --region TEXT     Which AWS region to use
+  -u, --user TEXT       Which user to connect as
+  --private / --public  Connect to the instance's private or public IP
+  -k, --key-file TEXT   Which key file to use to connect
+  --help                Show this message and exit.
+```

aws_ssh_utils-0.2.0/aws_ssh_utils/__init__.py

@@ -0,0 +1 @@
+__version__ = "0.2.0"

{aws_ssh_utils-0.1.0 → aws_ssh_utils-0.2.0}/aws_ssh_utils/emr_utils.py

@@ -161,13 +161,3 @@ def get_emr_instance_ips(
         ]
         for k, v in get_emr_instances(emr, cluster_id).items()
     }
-
-
-def get_instance_key_name(
-    emr: "EMRClient",
-    cluster_id: str,
-) -> str:
-    cluster = emr.describe_cluster(ClusterId=cluster_id)
-
-    key_name = cluster["Cluster"]["Ec2InstanceAttributes"]["Ec2KeyName"]
-    return key_name

{aws_ssh_utils-0.1.0 → aws_ssh_utils-0.2.0}/aws_ssh_utils/ssh.py

@@ -1,14 +1,18 @@
+import datetime as dt
 import logging
 import os
+import subprocess
 import sys
 import textwrap
-from dataclasses import dataclass
+from dataclasses import dataclass, field
+from hashlib import sha1
 from typing import TYPE_CHECKING
 
 import boto3
 import click
 import click_spinner
 import paramiko
+import paramiko.pkey
 import questionary
 from botocore.exceptions import ClientError
 from environs import Env
@@ -17,7 +21,6 @@ from loguru import logger
 from .emr_utils import (
     IP,
     get_emr_instance_ips,
-    get_instance_key_name,
     prompt_for_emr_cluster,
     prompt_for_emr_instance_group,
 )
@@ -28,6 +31,7 @@ if TYPE_CHECKING:
     from mypy_boto3_emr import EMRClient
 
 Env().read_env()  # Load .env file
+OPKSSH_PROVIDER_TAG = 'opkssh_provider'
 
 
 class ShellError(Exception):
@@ -248,13 +252,6 @@ def emr_ssh_all(
             exit(1)
 
 
-@cli.command('test')
-def test(**kwargs):
-    tmux('new-session -d -s "test" -n "window 1" "echo hello && $SHELL -i"')
-    tmux('new-window -n "window 2" -t "test:" "echo hello && $SHELL -i"')
-    tmux('switch-client -t "test:window 1"')
-
-
 @dataclass
 class SSHShell:
     hostname: str
@@ -262,6 +259,17 @@ class SSHShell:
     key_filename: str
     terminal_title: str = None
 
+    private_key: paramiko.PKey = field(init=False)
+
+    def __post_init__(self):
+        if not os.path.isfile(self.key_filename):
+            raise ValueError(f'File {self.key_filename} does not exist')
+
+        self.private_key = paramiko.PKey.from_path(self.key_filename)
+        public_key_path = f'{self.key_filename}.pub'
+        if os.path.isfile(public_key_path):
+            self.private_key.load_certificate(public_key_path)
+
     def connect(self):
         self._open()
         self._launch()
@@ -278,7 +286,11 @@ class SSHShell:
         ssh_client.load_host_keys(host_key_path)
         ssh_client.set_missing_host_key_policy(ConfirmAddPolicy())
         try:
-            ssh_client.connect(hostname=self.hostname, username=self.username, key_filename=self.key_filename)
+            ssh_client.connect(
+                hostname=self.hostname,
+                username=self.username,
+                pkey=self.private_key,
+            )
         except paramiko.BadHostKeyException as e:
             error_message = f'''
                 @@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
@@ -359,8 +371,18 @@ def get_ec2_ssh_options(
     key_file: str = None
 ) -> tuple[str, str, str, str]:
     instance = prompt_for_ec2_instance(b3s)
+    instance_tags = {
+        tag['Key'].lower(): tag['Value']
+        for tag in instance.tags
+    }
+
     if key_file is None:
-        key_file = try_to_find_ssh_key_file(instance.key_name)
+        # Support https://github.com/openpubkey/opkssh via tags
+        if OPKSSH_PROVIDER_TAG in instance_tags:
+           key_file = get_opkssh_key_file(instance_tags[OPKSSH_PROVIDER_TAG])
+
+        else:
+            key_file = try_to_find_ssh_key_file(instance.key_name)
 
     if user is None:
         logger.info('No user specified, attempting to detect required user...')
@@ -406,8 +428,17 @@ def get_emr_ssh_key_file_for_cluster(
     cluster_id: str,
 ) -> str:
     with click_spinner.spinner():
-        key_name = get_instance_key_name(emr, cluster_id)
-        key_file = try_to_find_ssh_key_file(key_name)
+        cluster = emr.describe_cluster(ClusterId=cluster_id)
+        cluster_tags = {
+            tag['Key'].lower(): tag['Value']
+            for tag in cluster['Cluster']['Tags']
+        }
+        # Support https://github.com/openpubkey/opkssh via tags
+        if OPKSSH_PROVIDER_TAG in cluster_tags:
+           key_file = get_opkssh_key_file(cluster_tags[OPKSSH_PROVIDER_TAG])
+        else:
+            key_name = cluster["Cluster"]["Ec2InstanceAttributes"]["Ec2KeyName"]
+            key_file = try_to_find_ssh_key_file(key_name)
 
     if key_file is None:
         should_continue = questionary.confirm(f'Could not find the ssh key {key_name}, would you like to continue?').unsafe_ask()
@@ -472,6 +503,23 @@ def get_ec2_name(ec2_instance: "Instance") -> str:
     return ec2_instance.instance_id
 
 
+def get_opkssh_key_file(provider: str) -> str:
+    opkssh_key_file = os.path.join(os.path.expanduser('~/.ssh/'), f'opkssh_{sha1(provider.encode()).hexdigest()}')
+
+    if os.path.exists(opkssh_key_file) and os.path.getmtime(opkssh_key_file) > dt.datetime.now().timestamp() - 86400:
+        logger.info('Found existing opkssh key')
+    else:
+        logger.info('Detected opkssh, logging in')
+        cmd = f"opkssh login --provider '{provider}' -i '{opkssh_key_file}'"
+        process = subprocess.Popen(cmd, shell=True, stdout=subprocess.PIPE)
+        process.wait()
+        if process.returncode != 0:
+            logger.error('Failed to authenticate using opkssh')
+            sys.exit(process.returncode)
+
+    return opkssh_key_file
+
+
 class ConfirmAddPolicy(paramiko.client.MissingHostKeyPolicy):
     """
     Policy for automatically adding the hostname and new host key to the

{aws_ssh_utils-0.1.0 → aws_ssh_utils-0.2.0}/pyproject.toml

@@ -41,7 +41,7 @@ dependencies = [
 dynamic = ["version"]
 
 [project.urls]
-Homepage = "https://github.com/mvanderlee/aws_ssh_utils"
+Homepage = "https://github.com/mvanderlee/aws-ssh-utils"
 
 [project.scripts]
 aws_ssh = "aws_ssh_utils.ssh:cli"

aws_ssh_utils-0.1.0/PKG-INFO

@@ -1,113 +0,0 @@
-Metadata-Version: 2.4
-Name: aws-ssh-utils
-Version: 0.1.0
-Summary: Easy AWS SSHing
-Project-URL: Homepage, https://github.com/mvanderlee/aws_ssh_utils
-Author-email: Michiel Vanderlee <jmt.vanderlee@gmail.com>
-License-Expression: MIT
-Classifier: Intended Audience :: Developers
-Classifier: Intended Audience :: Information Technology
-Classifier: Intended Audience :: System Administrators
-Classifier: License :: OSI Approved :: MIT License
-Classifier: Operating System :: OS Independent
-Classifier: Programming Language :: Python
-Classifier: Programming Language :: Python :: 3 :: Only
-Classifier: Programming Language :: Python :: 3.11
-Classifier: Programming Language :: Python :: 3.12
-Classifier: Programming Language :: Python :: 3.13
-Classifier: Topic :: Software Development
-Classifier: Topic :: Software Development :: Libraries
-Classifier: Topic :: Software Development :: Libraries :: Python Modules
-Classifier: Typing :: Typed
-Requires-Python: >=3.11
-Requires-Dist: boto3
-Requires-Dist: click
-Requires-Dist: click-spinner
-Requires-Dist: coloredlogs
-Requires-Dist: environs
-Requires-Dist: loguru
-Requires-Dist: paramiko
-Requires-Dist: questionary
-Provides-Extra: dev
-Requires-Dist: boto3-stubs[ec2,emr]; extra == 'dev'
-Provides-Extra: publish
-Requires-Dist: hatch>=1.7.0; extra == 'publish'
-Provides-Extra: test
-Description-Content-Type: text/markdown
-
-# AWS Auth
-
-```shell
-pip install aws-auth-utils
-
-aws configure --profile mfa-source
-
-aws_auth mfa
-```
-
-The commands use [click](https://click.palletsprojects.com/en/stable/) for argument parsing and if required arguments are missing it will prompt you.
-
-To authenticate using your MFA token you will need to have a profile configured using regular an AWS Access Key.
-
-We will use that and your MFA token to generate an authorized session profile.
-By default we will try to use the `mfa-source` and create the `default` profile.
-
-If you only have a single MFA device set up, it will use that automatically. If you have multiple, it will the first one.
-
-## MFA
-
-```shell
-$ aws_auth mfa --help
-Usage: aws_auth mfa [OPTIONS]
-
-Options:
-  -a, --mfa-arn TEXT          The identification number of the MFA device that
-                              is associated with the IAM user. i.e.:
-                              "arn:aws:iam::123456789012:mfa/tony.stark". You
-                              can find this on the IAM page.
-  -c, --code TEXT             The code generated by your MFA device.
-  -d, --duration INTEGER      The duration, in seconds, of the session.
-  -sp, --source-profile TEXT  What AWS profile to get the session token with.
-  -tp, --target-profile TEXT  What AWS profile to store the credentials under.
-  -v, --verbose BOOLEAN
-  --help                      Show this message and exit.
-```
-
-## Assume Role
-
-The assume role is useful for multi-org environments where you want to impersonate a role in a child organization.
-If you access multiple organizations I recommend you set up aliases.
-
-```shell
-aws_auth assume \
-  --role-arn arn:aws:iam::123456789012:role/OrganizationAccountAccessRole \
-  --session-name child_org \
-  --target-profile child_session
-```
-
-```shell
-$ aws_auth assume --help
-Usage: aws_auth assume [OPTIONS]
-
-  Get MFA authenticated and assumed role session credentials and save them to
-  the aws credentials file
-
-  If you have multiple accounts you'd like to switch between, I recommend
-  setting up aliases that call this script with predefined arguments.
-
-Options:
-  -r, --role-arn TEXT         The Arn of the Role to assume.
-  -n, --session-name TEXT     The identifier for the assumed role session.
-  -a, --mfa-arn TEXT          The identification number of the MFA device that
-                              is associated with the IAM user. i.e.:
-                              "arn:aws:iam::123456789012:mfa/tony.stark". You
-                              can find this on the IAM page.
-  -c, --code TEXT             The code generated by your MFA device.
-  -d, --duration INTEGER      The duration, in seconds, of the session.
-                              (defaults to 4 hours)
-  -sp, --source-profile TEXT  What AWS profile to get the session token with.
-  -tp, --target-profile TEXT  What AWS profile to store the credentials under.
-  -v, --verbose BOOLEAN
-  --help                      Show this message and exit.
-```
-

aws_ssh_utils-0.1.0/README.md

@@ -1,76 +0,0 @@
-# AWS Auth
-
-```shell
-pip install aws-auth-utils
-
-aws configure --profile mfa-source
-
-aws_auth mfa
-```
-
-The commands use [click](https://click.palletsprojects.com/en/stable/) for argument parsing and if required arguments are missing it will prompt you.
-
-To authenticate using your MFA token you will need to have a profile configured using regular an AWS Access Key.
-
-We will use that and your MFA token to generate an authorized session profile.
-By default we will try to use the `mfa-source` and create the `default` profile.
-
-If you only have a single MFA device set up, it will use that automatically. If you have multiple, it will the first one.
-
-## MFA
-
-```shell
-$ aws_auth mfa --help
-Usage: aws_auth mfa [OPTIONS]
-
-Options:
-  -a, --mfa-arn TEXT          The identification number of the MFA device that
-                              is associated with the IAM user. i.e.:
-                              "arn:aws:iam::123456789012:mfa/tony.stark". You
-                              can find this on the IAM page.
-  -c, --code TEXT             The code generated by your MFA device.
-  -d, --duration INTEGER      The duration, in seconds, of the session.
-  -sp, --source-profile TEXT  What AWS profile to get the session token with.
-  -tp, --target-profile TEXT  What AWS profile to store the credentials under.
-  -v, --verbose BOOLEAN
-  --help                      Show this message and exit.
-```
-
-## Assume Role
-
-The assume role is useful for multi-org environments where you want to impersonate a role in a child organization.
-If you access multiple organizations I recommend you set up aliases.
-
-```shell
-aws_auth assume \
-  --role-arn arn:aws:iam::123456789012:role/OrganizationAccountAccessRole \
-  --session-name child_org \
-  --target-profile child_session
-```
-
-```shell
-$ aws_auth assume --help
-Usage: aws_auth assume [OPTIONS]
-
-  Get MFA authenticated and assumed role session credentials and save them to
-  the aws credentials file
-
-  If you have multiple accounts you'd like to switch between, I recommend
-  setting up aliases that call this script with predefined arguments.
-
-Options:
-  -r, --role-arn TEXT         The Arn of the Role to assume.
-  -n, --session-name TEXT     The identifier for the assumed role session.
-  -a, --mfa-arn TEXT          The identification number of the MFA device that
-                              is associated with the IAM user. i.e.:
-                              "arn:aws:iam::123456789012:mfa/tony.stark". You
-                              can find this on the IAM page.
-  -c, --code TEXT             The code generated by your MFA device.
-  -d, --duration INTEGER      The duration, in seconds, of the session.
-                              (defaults to 4 hours)
-  -sp, --source-profile TEXT  What AWS profile to get the session token with.
-  -tp, --target-profile TEXT  What AWS profile to store the credentials under.
-  -v, --verbose BOOLEAN
-  --help                      Show this message and exit.
-```
-

aws_ssh_utils-0.1.0/aws_ssh_utils/__init__.py

@@ -1 +0,0 @@
-__version__ = "0.1.0"