leverage 2.2.0rc3__tar.gz → 2.2.0rc5__tar.gz

{leverage-2.2.0rc3 → leverage-2.2.0rc5}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.1
 Name: leverage
-Version: 2.2.0rc3
+Version: 2.2.0rc5
 Summary: Binbash Leverage Command-Line tool.
 Home-page: https://github.com/binbashar/leverage
 License: MIT

{leverage-2.2.0rc3 → leverage-2.2.0rc5}/leverage/__init__.py

@@ -4,7 +4,7 @@
 
 # pylint: disable=wrong-import-position
 
-__version__ = "2.2.0rc3"
+__version__ = "2.2.0rc5"
 
 import sys
 from shutil import which

{leverage-2.2.0rc3 → leverage-2.2.0rc5}/leverage/_internals.py

@@ -30,6 +30,7 @@ class State:
         self.config = None
         self.paths = None
         self.runner = None
+        self.environment = None
 
     @property
     def verbosity(self):
@@ -65,3 +66,15 @@ def pass_paths(command):
         return command(ctx.obj.paths, *args, **kwargs)
 
     return new_command
+
+
+def pass_environment(command):
+    """Decorator to pass the current environment to the command."""
+
+    @wraps(command)
+    def new_command(*args, **kwargs):
+        ctx = click.get_current_context()
+
+        return command(ctx.obj.environment, *args, **kwargs)
+
+    return new_command

{leverage-2.2.0rc3 → leverage-2.2.0rc5}/leverage/leverage.py

@@ -28,6 +28,10 @@ def leverage(context, state, verbose):
     except NotARepositoryError:
         return
     state.paths = PathsHandler(state.config)
+    state.environment = {
+        "AWS_SHARED_CREDENTIALS_FILE": str(state.paths.aws_credentials_file),
+        "AWS_CONFIG_FILE": str(state.paths.aws_config_file),
+    }
 
 
 # Add modules to leverage

{leverage-2.2.0rc3 → leverage-2.2.0rc5}/leverage/modules/auth.py

@@ -1,12 +1,16 @@
 import time
 import json
 from pathlib import Path
-from datetime import datetime
+from datetime import datetime, timedelta
+from functools import wraps
 from configparser import NoSectionError, NoOptionError
 
 import boto3
-from botocore.exceptions import ClientError
+import click
+from dateutil.tz import tzutc
 from configupdater import ConfigUpdater
+from botocore.session import get_session
+from botocore.exceptions import ClientError
 
 from leverage import logger
 from leverage.path import PathsHandler
@@ -24,7 +28,7 @@ def get_layer_profile(raw_profile: str, config_updater: ConfigUpdater, tf_profil
         raise SkipProfile
 
     # if it is exactly that variable, we already know the layer profile is tf_profile
-    layer_profile = tf_profile if raw_profile in ("${var.profile}", "each.value.profile") else None
+    layer_profile = tf_profile if raw_profile in ("var.profile", "each.value.profile") else None
 
     # replace variables with their corresponding values
     raw = (
@@ -94,6 +98,50 @@ def get_sso_access_token(sso_token_file: Path) -> str:
     return json.loads(sso_token_file.read_text())["accessToken"]
 
 
+def _perform_authentication(paths: PathsHandler):
+    """Perform authentication checks and credential refresh.
+
+    This function contains the core authentication logic that checks for SSO or MFA
+    configuration and refreshes credentials accordingly. Only authenticates when
+    in a layer location.
+
+    Args:
+        paths: PathsHandler instance containing project paths and configuration
+    """
+    if paths.get_location_type() == "layer":
+        if paths.common_conf.get("sso_enabled", False):
+            check_sso_token(paths)
+            refresh_layer_credentials(paths)
+        elif paths.mfa_enabled:
+            refresh_layer_credentials_mfa(paths)
+
+
+def authenticate(command):
+    """Decorator to require authentication before running a command.
+
+    This decorator extracts the PathsHandler from the Click context and performs
+    authentication checks before executing the wrapped command. It handles both SSO
+    and MFA authentication based on the project configuration.
+
+    Usage:
+        @click.command()
+        @authenticate
+        @pass_paths
+        @pass_runner
+        def some_command(tf: TFRunner, paths: PathsHandler, args):
+            # command logic
+    """
+
+    @wraps(command)
+    def new_command(*args, **kwargs):
+        ctx = click.get_current_context()
+        paths = ctx.obj.paths
+        _perform_authentication(paths)
+        return command(*args, **kwargs)
+
+    return new_command
+
+
 def check_sso_token(paths: PathsHandler):
     """Check for the existence and validity of the SSO token to be used to get credentials."""
 
@@ -203,3 +251,128 @@ def refresh_layer_credentials(paths: PathsHandler):
             },
         )
         logger.info(f"Credentials for {account_name} account written successfully.")
+
+
+def refresh_layer_credentials_mfa(paths: PathsHandler):
+    tf_profile, raw_profiles = get_profiles(paths)
+    config_updater = ConfigUpdater()
+    config_updater.read(paths.aws_config_file)
+
+    # Create STS client with source profile credentials
+    session = get_session()
+    session.set_config_variable("credentials_file", paths.aws_credentials_file.as_posix())
+    session.set_config_variable("config_file", paths.aws_config_file.as_posix())
+
+    for raw_profile in raw_profiles:
+        if "local." in raw_profile:
+            # ignore values referencing to local variables
+            # we will search for profiles directly in locals.tf instead
+            continue
+
+        # if it is exactly that variable, we already know the layer profile is tf_profile
+        layer_profile = tf_profile if raw_profile in ("var.profile", "each.value.profile") else None
+
+        # replace variables with their corresponding values
+        profile_name = (
+            raw_profile.replace("${var.profile}", tf_profile)
+            .replace("${var.project}", paths.project)
+            .replace("each.value.profile", tf_profile)
+        )
+
+        # if layer_profile wasn't set, use profile_name
+        if layer_profile is None:
+            layer_profile = profile_name
+
+        logger.info(f"Attempting to get temporary credentials for {profile_name} profile.")
+        if profile := config_updater.get_section(f"profile {profile_name}-mfa"):
+            role_arn = profile.get("role_arn").value
+            mfa_serial = profile.get("mfa_serial").value
+            source_profile = profile.get("source_profile").value
+        else:
+            raise ExitError(
+                40,
+                f"Credentials for profile {profile_name} have not been properly configured. Please check your configuration.\n"
+                f"Check the following link for possible solutions: https://leverage.binbash.co/user-guide/troubleshooting/credentials/",
+            )
+
+        if not paths.aws_cache_dir.exists():
+            paths.aws_cache_dir.mkdir(parents=True)
+
+        cache_file = paths.aws_cache_dir / profile_name
+        if cache_file.exists():
+            logger.debug(f"Found cached credentials in {cache_file}.")
+            cached_credentials = json.loads(cache_file.read_text())
+
+            expiration = datetime.strptime(cached_credentials.get("Expiration"), "%Y-%m-%dT%H:%M:%SZ").replace(
+                tzinfo=tzutc()
+            )
+            renewal = datetime.now(tzutc()) + timedelta(seconds=(30 * 60))
+            if renewal < expiration:
+                logger.info("Using cached credentials.")
+                continue
+
+        else:
+            logger.debug("No cached credentials found.")
+
+        client_session = boto3.Session(botocore_session=session, profile_name=source_profile)
+        client = client_session.client("sts")
+        credentials = None
+        for _ in range(3):
+            try:
+                mfa_token_code = click.prompt("Enter MFA token code", type=str)
+            except click.exceptions.Abort:
+                raise ExitError(1, "Aborted by user.")
+
+            try:
+                credentials = client.assume_role(
+                    RoleArn=role_arn,
+                    RoleSessionName=f"leverage-{profile_name}",
+                    SerialNumber=mfa_serial,
+                    TokenCode=mfa_token_code,
+                )
+                credentials = credentials["Credentials"]
+                credentials["Expiration"] = credentials["Expiration"].strftime("%Y-%m-%dT%H:%M:%SZ")
+                cache_file.write_text(json.dumps(credentials))
+                break
+
+            except ClientError as error:
+                if "invalid MFA" in error.response["Error"]["Message"]:
+                    logger.error("Unable to get valid credentials. Please try again.")
+                    continue
+                elif error.response["Error"]["Code"] == "AccessDeniedException":
+                    raise ExitError(
+                        40,
+                        f"User does not have permission to assume role [bold]{role_arn}[/bold]"
+                        " in this account.\nPlease check with your administrator or try"
+                        " checking your credentials configuration.",
+                    )
+                elif error.response["Error"]["Code"] == "ExpiredToken":
+                    logger.error("Token has expired. Please try again.")
+                    continue
+                elif (
+                    error.response["Error"]["Code"] == "ValidationError"
+                    and "Invalid length for parameter TokenCode" in error.response["Error"]["Message"]
+                ):
+                    logger.error("Invalid token length, it must be 6 digits long. Please try again.")
+                    continue
+                elif "An error occurred" in error.response["Error"]["Message"]:
+                    raise ExitError(50, f"Error assuming role: {error}")
+
+        if credentials is None:
+            raise ExitError(60, "Failed to get credentials after 3 attempts. Please try again later.")
+
+        # write credentials on aws/<project>/credentials (create the file if it doesn't exist first)
+        paths.aws_credentials_file.touch(exist_ok=True)
+        credentials_updater = ConfigUpdater()
+        credentials_updater.read(paths.aws_credentials_file)
+
+        update_config_section(
+            credentials_updater,
+            layer_profile,
+            data={
+                "aws_access_key_id": credentials["AccessKeyId"],
+                "aws_secret_access_key": credentials["SecretAccessKey"],
+                "aws_session_token": credentials["SessionToken"],
+            },
+        )
+        logger.info(f"Credentials written successfully.")

{leverage-2.2.0rc3 → leverage-2.2.0rc5}/leverage/modules/aws.py

@@ -15,7 +15,8 @@ from leverage.modules.runner import Runner
 from leverage.modules.utils import _handle_subcommand
 from leverage._utils import get_or_create_section, ExitError
 from leverage._internals import pass_state, pass_runner, pass_paths
-from leverage.modules.auth import get_sso_access_token, check_sso_token, refresh_layer_credentials
+from leverage.modules.auth import get_sso_access_token
+from leverage.modules.auth import _perform_authentication as perform_authentication
 
 
 CONTEXT_SETTINGS = {"ignore_unknown_options": True}
@@ -24,21 +25,6 @@ CONTEXT_SETTINGS = {"ignore_unknown_options": True}
 AWS_SSO_LOGIN_URL = "{sso_url}/#/device?user_code={user_code}"
 
 
-@pass_paths
-def refresh_aws_credentials(paths: PathsHandler) -> None:
-    """
-    Refresh the AWS credentials for the current project.
-    """
-    check_sso_token(paths)
-
-    try:  # if we are not in a layer, we don't need to refresh the credentials
-        paths.check_for_layer_location()
-    except ExitError:
-        return
-
-    refresh_layer_credentials(paths)
-
-
 def get_account_roles(sso_client: Any, access_token: str) -> Dict[str, Dict[str, str]]:
     """
     Fetch the accounts and roles from the user.
@@ -116,21 +102,17 @@ def configure_sso_profiles(paths: PathsHandler) -> None:
 @click.pass_context
 def aws(context: click.Context, state: Any, args: Tuple[str, ...]) -> None:
     """Run AWS CLI commands in the context of the current project."""
-
-    credentials_env_vars = {
-        "AWS_SHARED_CREDENTIALS_FILE": str(state.paths.aws_credentials_file),
-        "AWS_CONFIG_FILE": str(state.paths.aws_config_file),
-    }
     state.runner = Runner(
         binary="aws",
         error_message=(
             f"AWS CLI not found on system. "
             f"Please install it following the instructions at: https://docs.aws.amazon.com/cli/latest/userguide/getting-started-install.html"
         ),
-        env_vars=credentials_env_vars,
+        env_vars=state.environment,
     )
 
-    _handle_subcommand(context=context, runner=state.runner, args=args, pre_invocation_callback=refresh_aws_credentials)
+    authenticate = pass_paths(lambda paths: perform_authentication(paths))
+    _handle_subcommand(context=context, runner=state.runner, args=args, pre_invocation_callback=authenticate)
 
 
 @aws.group(invoke_without_command=True, add_help_option=False, context_settings=CONTEXT_SETTINGS)

{leverage-2.2.0rc3 → leverage-2.2.0rc5}/leverage/modules/credentials.py

@@ -2,9 +2,10 @@
     Credentials managing module.
 """
 
+import re
 import csv
 import json
-import re
+import shutil
 from pathlib import Path
 from functools import wraps
 from typing import Optional, Union
@@ -287,17 +288,13 @@ def credentials(state):
     else:
         logger.info("Reading info from build.env")
 
-    credentials_env_vars = {
-        "AWS_SHARED_CREDENTIALS_FILE": str(state.paths.aws_credentials_file),
-        "AWS_CONFIG_FILE": str(state.paths.aws_config_file),
-    }
     state.runner = Runner(
         binary="aws",
         error_message=(
             f"AWS CLI not found on system. "
             f"Please install it following the instructions at: https://docs.aws.amazon.com/cli/latest/userguide/getting-started-install.html"
         ),
-        env_vars=credentials_env_vars,
+        env_vars=state.environment,
     )
 
 
@@ -375,7 +372,7 @@ def _profile_is_configured(awscli: Runner, profile: str):
     Returns:
         bool: Whether the profile was already configured or not.
     """
-    exit_code, _ = awscli.exec("configure", "list", "--profile", profile)
+    exit_code, _, _ = awscli.exec("configure", "list", "--profile", profile)
 
     return not exit_code
 
@@ -444,12 +441,12 @@ def configure_credentials(
 
     if make_backup:
         logger.info("Backing up credentials file.")
-        Path(paths.aws_credentials_file).copy(Path(paths.aws_credentials_file).with_suffix(".bkp"))
+        shutil.copy(paths.aws_credentials_file, paths.aws_credentials_file.with_suffix(".bkp"))
 
     values = {"aws_access_key_id": key_id, "aws_secret_access_key": secret_key}
 
     for key, value in values.items():
-        exit_code, output = awscli.exec("configure", "set", key, value, "--profile", profile)
+        exit_code, output, _ = awscli.exec("configure", "set", key, value, "--profile", profile)
         if exit_code:
             raise ExitError(exit_code, f"AWS CLI error: {output}")
 
@@ -470,7 +467,7 @@ def _credentials_are_valid(awscli: Runner, profile: str):
     Returns:
         bool: Whether the credentials are valid.
     """
-    error_code, output = awscli.exec("sts", "get-caller-identity", "--profile", profile)
+    error_code, output, _ = awscli.exec("sts", "get-caller-identity", "--profile", profile)
 
     return error_code != 255 and "InvalidClientTokenId" not in output
 
@@ -485,7 +482,7 @@ def _get_management_account_id(awscli: Runner, profile: str):
     Returns:
         str: Management account id.
     """
-    exit_code, caller_identity = awscli.exec("sts", "get-caller-identity", "--output", "json", "--profile", profile)
+    exit_code, caller_identity, _ = awscli.exec("sts", "get-caller-identity", "--output", "json", "--profile", profile)
     if exit_code:
         raise ExitError(exit_code, f"AWS CLI error: {caller_identity}")
 
@@ -504,7 +501,7 @@ def _get_organization_accounts(awscli: Runner, profile: str, project_name: str):
     Returns:
         dict: Mapping of organization accounts names to ids.
     """
-    exit_code, organization_accounts = awscli.exec(
+    exit_code, organization_accounts, _ = awscli.exec(
         "organizations", "list-accounts", "--output", "json", "--profile", profile
     )
 
@@ -533,7 +530,7 @@ def _get_mfa_serial(awscli: Runner, profile: str):
     Returns:
         str: MFA device serial.
     """
-    exit_code, mfa_devices = awscli.exec("iam", "list-mfa-devices", "--output", "json", "--profile", profile)
+    exit_code, mfa_devices, _ = awscli.exec("iam", "list-mfa-devices", "--output", "json", "--profile", profile)
     if exit_code:
         raise ExitError(exit_code, f"AWS CLI error: {mfa_devices}")
     mfa_devices = json.loads(mfa_devices)
@@ -561,7 +558,7 @@ def configure_profile(awscli: Runner, profile: str, values: dict):
     """
     logger.info(f"\tConfiguring profile [bold]{profile}[/bold]")
     for key, value in values.items():
-        exit_code, output = awscli.exec("configure", "set", key, value, "--profile", profile)
+        exit_code, output, _ = awscli.exec("configure", "set", key, value, "--profile", profile)
         if exit_code:
             raise ExitError(exit_code, f"AWS CLI error: {output}")
 
@@ -614,10 +611,10 @@ def configure_accounts_profiles(
         if mfa_serial:
             account_profile["mfa_serial"] = mfa_serial
         # A profile identifier looks like `le-security-oaar`
-        account_profiles[f"{short_name}-{account_name}-{PROFILES[_type]['profile_role']}"] = account_profile
+        account_profiles[f"{short_name}-{account_name}-{PROFILES[_type]['profile_role']}-mfa"] = account_profile
 
     logger.info("Backing up account profiles file.")
-    Path(paths.aws_config_file).copy(Path(paths.aws_config_file).with_suffix(".bkp"))
+    shutil.copy(paths.aws_config_file, paths.aws_config_file.with_suffix(".bkp"))
 
     for profile_identifier, profile_values in account_profiles.items():
         configure_profile(profile_identifier, profile_values)

{leverage-2.2.0rc3 → leverage-2.2.0rc5}/leverage/modules/kubectl.py

@@ -14,8 +14,8 @@ from leverage.modules.aws import aws
 from leverage.modules.runner import Runner
 from leverage.modules.tfrunner import TFRunner
 from leverage.modules.utils import _handle_subcommand
-from leverage.modules.auth import check_sso_token, refresh_layer_credentials
-from leverage._internals import pass_state, pass_paths
+from leverage.modules.auth import _perform_authentication as perform_authentication
+from leverage._internals import pass_state, pass_paths, pass_environment
 
 
 @dataclass
@@ -29,26 +29,9 @@ class MetadataTypes(Enum):
     K8S_CLUSTER = "k8s-eks-cluster"
 
 
-CONTEXT_SETTINGS = {"ignore_unknown_options": True}
-
 METADATA_FILENAME = "metadata.yaml"
 
 
-@pass_paths
-def refresh_kubectl_credentials(paths: PathsHandler) -> None:
-    """
-    Refresh the AWS credentials for the current project to be used by kubectl.
-    """
-    check_sso_token(paths)
-
-    try:  # if we are not in a layer, we don't need to refresh the credentials
-        paths.check_for_layer_location()
-    except ExitError:
-        return
-
-    refresh_layer_credentials(paths)
-
-
 @click.group(invoke_without_command=True, context_settings={"ignore_unknown_options": True})
 @click.argument("args", nargs=-1, type=click.UNPROCESSED)
 @pass_state
@@ -58,26 +41,22 @@ def kubectl(context, state, args):
 
     kubeconfig_dir = state.paths.home / ".kube" / state.paths.project
     kubeconfig_dir.mkdir(parents=True, exist_ok=True)
+    state.environment["KUBECONFIG"] = str(kubeconfig_dir / "config")
 
-    credentials_env_vars = {
-        "AWS_SHARED_CREDENTIALS_FILE": str(state.paths.aws_credentials_file),
-        "AWS_CONFIG_FILE": str(state.paths.aws_config_file),
-        "KUBECONFIG": str(kubeconfig_dir / "config"),
-    }
     state.runner = Runner(
         binary="kubectl",
         error_message=(
             f"Kubectl not found on system. "
             f"Please install it following the instructions at: https://kubernetes.io/docs/tasks/tools/#kubectl"
         ),
-        env_vars=credentials_env_vars,
-    )
-    _handle_subcommand(
-        context=context, runner=state.runner, args=args, pre_invocation_callback=refresh_kubectl_credentials
+        env_vars=state.environment,
     )
 
+    authenticate = pass_paths(lambda paths: perform_authentication(paths))
+    _handle_subcommand(context=context, runner=state.runner, args=args, pre_invocation_callback=authenticate)
+
 
-def _configure(ci: ClusterInfo = None, layer_path: Path = None):
+def _configure(environment: dict, ci: ClusterInfo = None, layer_path: Path = None):
     """
     Add the given EKS cluster configuration to the .kube/ files.
     """
@@ -87,33 +66,31 @@ def _configure(ci: ClusterInfo = None, layer_path: Path = None):
     else:
         # otherwise go get them from the layer
         logger.info("Retrieving k8s cluster information...")
-        cmd = _get_eks_kube_config(layer_path).split(" ")[1:]
+        cmd = _get_eks_kube_config(environment, layer_path).split(" ")[1:]
 
     logger.info("Configuring context...")
     try:
-        click.get_current_context().invoke(aws, args=cmd)
+        exit_code, _, _ = Runner(binary="aws", env_vars=environment).exec(*cmd)
     except ExitError as e:
-        raise ExitError(e.exit_code, f"Failed to configure kubectl context: {e.message}")
+        raise ExitError(e.exit_code, f"Could not locate AWS cli binary.")
+    if exit_code:
+        raise ExitError(exit_code, f"Failed to configure kubectl context: {exit_code}")
 
     logger.info("Done.")
 
 
 @pass_paths
-def _get_eks_kube_config(paths: PathsHandler, layer_path: Path) -> str:
+def _get_eks_kube_config(paths: PathsHandler, environment: dict, layer_path: Path) -> str:
     # TODO: Get rid of this ugly workaround
-    credentials_env_vars = {
-        "AWS_SHARED_CREDENTIALS_FILE": str(paths.aws_credentials_file),
-        "AWS_CONFIG_FILE": str(paths.aws_config_file),
-    }
     try:
-        tfrunner = TFRunner(binary=paths.tf_binary, env_vars=credentials_env_vars)
+        tfrunner = TFRunner(binary=paths.tf_binary, env_vars=environment)
     except ExitError as e:
         try:
-            tfrunner = TFRunner(binary=paths.tf_binary, terraform=True, env_vars=credentials_env_vars)
+            tfrunner = TFRunner(binary=paths.tf_binary, terraform=True, env_vars=environment)
         except ExitError:
-            raise ExitError(1, "Could not locate TF binary.")
+            raise ExitError(e.exit_code, f"Could not locate TF binary.")
 
-    refresh_kubectl_credentials()
+    perform_authentication(paths)
     exit_code, output, error = tfrunner.exec("output", "-no-color", working_dir=layer_path)
     if exit_code:
         raise ExitError(exit_code, f"Failed to get EKS kube config: {error}")
@@ -126,18 +103,20 @@ def _get_eks_kube_config(paths: PathsHandler, layer_path: Path) -> str:
     return aws_eks_cmd + f" --region {region}"
 
 
-@kubectl.command(context_settings=CONTEXT_SETTINGS)
+@kubectl.command()
 @pass_paths
-def configure(paths: PathsHandler):
+@pass_environment
+def configure(environment: dict, paths: PathsHandler):
     """Automatically add the EKS cluster from the layer into your kubectl config file."""
-    _configure(layer_path=paths.cwd)
+    paths.check_for_cluster_layer()
+    _configure(environment, layer_path=paths.cwd)
 
 
-def _scan_clusters(paths: PathsHandler):
+def _scan_clusters(cwd: Path):
     """
     Scan all the subdirectories in search of "cluster" metadata files.
     """
-    for root, dirs, files in os.walk(paths.paths.cwd):
+    for root, dirs, files in os.walk(cwd):
         # exclude hidden directories
         dirs[:] = [d for d in dirs if d[0] != "."]
 
@@ -158,14 +137,15 @@ def _scan_clusters(paths: PathsHandler):
                 yield Path(root), data
 
 
-@kubectl.command(context_settings=CONTEXT_SETTINGS)
+@kubectl.command()
 @pass_paths
-def discover(paths: PathsHandler):
+@pass_environment
+def discover(environment: dict, paths: PathsHandler):
     """
     Do a scan down the tree of subdirectories looking for k8s clusters metadata files.
     Open up a menu with all the found items, where you can pick up and configure it on your .kubeconfig file.
     """
-    cluster_files = [(path, data) for path, data in _scan_clusters(paths)]
+    cluster_files = [(path, data) for path, data in _scan_clusters(paths.cwd)]
     if not cluster_files:
         raise ExitError(1, "No clusters found.")
 
@@ -185,4 +165,4 @@ def discover(paths: PathsHandler):
         region=cluster_data["data"]["region"],
     )
 
-    _configure(cluster_info, layer_path)
+    _configure(environment, cluster_info, layer_path)

{leverage-2.2.0rc3 → leverage-2.2.0rc5}/leverage/modules/runner.py

@@ -64,6 +64,7 @@ class Runner:
         env_vars: Optional[Dict[str, str]] = None,
         working_dir: Optional[Path] = None,
         interactive: bool = True,
+        raises: bool = False,
     ) -> Union[int, Tuple[int, str, str]]:
         """
         Execute command with the binary.
@@ -73,6 +74,7 @@ class Runner:
             env_vars: Environment variables to set during execution (overrides instance env_vars)
             working_dir: Working directory for command execution
             interactive: If True, run interactively. If False, capture output
+            raises: If True, raise an ExitError if the command fails
 
         Returns:
             If interactive=True: Exit code (int)
@@ -93,17 +95,23 @@ class Runner:
         logger.debug(f"Working directory: {working_dir or Path.cwd()}")
         logger.debug(f"Additional environment variables: {merged_env_vars}")
 
-        if interactive:
-            # Interactive execution
-            process = subprocess.run(command, env=env, cwd=working_dir)
-            return process.returncode
-        else:
-            # Silent execution with output capture
-            process = subprocess.run(command, env=env, cwd=working_dir, capture_output=True, text=True)
-            return process.returncode, process.stdout.strip(), process.stderr.strip()
+        process = subprocess.run(
+            command, env=env, cwd=working_dir, capture_output=not interactive, text=not interactive
+        )
+
+        if raises and not interactive and process.returncode:
+            raise ExitError(process.returncode, f"Command execution failed: {process.stderr.strip()}")
+
+        return (
+            process.returncode if interactive else (process.returncode, process.stdout.strip(), process.stderr.strip())
+        )
 
     def exec(
-        self, *args: str, env_vars: Optional[Dict[str, str]] = None, working_dir: Optional[Path] = None
+        self,
+        *args: str,
+        env_vars: Optional[Dict[str, str]] = None,
+        working_dir: Optional[Path] = None,
+        raises: bool = True,
     ) -> Tuple[int, str, str]:
         """
         Execute command with the binary in non-interactive mode (captures output).
@@ -114,11 +122,12 @@ class Runner:
             *args: Command arguments to pass to the binary
             env_vars: Environment variables to set during execution (overrides instance env_vars)
             working_dir: Working directory for command execution
+            raises: If True, raise an ExitError if the command fails. If False, return the exit code.
 
         Returns:
             Tuple of (exit_code, stdout, stderr)
         """
-        return self.run(*args, env_vars=env_vars, working_dir=working_dir, interactive=False)
+        return self.run(*args, env_vars=env_vars, working_dir=working_dir, interactive=False, raises=raises)
 
     def __repr__(self):
         return f"Runner(binary_input='{self.binary_input}', binary_path='{self.binary_path}')"

{leverage-2.2.0rc3 → leverage-2.2.0rc5}/leverage/modules/tf.py

@@ -11,7 +11,7 @@ from leverage.modules.tfrunner import TFRunner
 from leverage._utils import ExitError, parse_tf_file
 from leverage._internals import pass_paths, pass_runner, pass_state
 from leverage._backend_config import get_backend_key, set_backend_key
-from leverage.modules.auth import refresh_layer_credentials, check_sso_token
+from leverage.modules.auth import authenticate
 
 REGION = r"(global|([a-z]{2}(-gov)?)-(central|(north|south)?(east|west)?)-\d)"
 
@@ -28,11 +28,7 @@ def tofu(state):
     counterparts in the container. For example as in `leverage tofu apply -auto-approve` or
     `leverage tofu init -reconfigure`
     """
-    credentials_env_vars = {
-        "AWS_SHARED_CREDENTIALS_FILE": str(state.paths.aws_credentials_file),
-        "AWS_CONFIG_FILE": str(state.paths.aws_config_file),
-    }
-    state.runner = TFRunner(binary=state.paths.tf_binary, env_vars=credentials_env_vars)
+    state.runner = TFRunner(binary=state.paths.tf_binary, env_vars=state.environment)
 
 
 @click.group()
@@ -44,11 +40,7 @@ def terraform(state):
     counterparts in the container. For example as in `leverage terraform apply -auto-approve` or
     `leverage terraform init -reconfigure`
     """
-    credentials_env_vars = {
-        "AWS_SHARED_CREDENTIALS_FILE": str(state.paths.aws_credentials_file),
-        "AWS_CONFIG_FILE": str(state.paths.aws_config_file),
-    }
-    state.runner = TFRunner(binary=state.paths.tf_binary, terraform=True, env_vars=credentials_env_vars)
+    state.runner = TFRunner(binary=state.paths.tf_binary, terraform=True, env_vars=state.environment)
 
 
 CONTEXT_SETTINGS = {"ignore_unknown_options": True}
@@ -170,25 +162,21 @@ def _format(tf, args):
 
 @click.command("force-unlock")
 @click.argument("lock_id", metavar="LOCK_ID")
+@authenticate
 @pass_paths
 @pass_runner
 def force_unlock(tf, paths: PathsHandler, lock_id):
     """Force unlock the state file."""
-    check_sso_token(paths)
-    refresh_layer_credentials(paths)
-    if exit_code := tf.run("force-unlock", lock_id):
-        raise Exit(exit_code)
+    tf.run("force-unlock", lock_id)
 
 
 @click.command()
+@authenticate
 @pass_paths
 @pass_runner
 def validate(tf, paths: PathsHandler):
     """Validate code of the current directory. Previous initialization might be needed."""
-    check_sso_token(paths)
-    refresh_layer_credentials(paths)
-    if exit_code := tf.run("validate", *tf_default_args()):
-        raise Exit(exit_code)
+    tf.run("validate", *tf_default_args())
 
 
 @click.command("validate-layout")
@@ -204,17 +192,15 @@ def validate_layout(paths):
 @pass_runner
 def _import(tf, address, _id):
     """Import a resource."""
-    if exit_code := tf.run("import", *tf_default_args(), address, _id):
-        raise Exit(exit_code)
+    tf.run("import", *tf_default_args(), address, _id)
 
 
 @click.command("refresh-credentials")
+@authenticate
 @pass_paths
 def refresh_credentials(paths):
     """Refresh the AWS credentials used on the current layer."""
     paths.check_for_layer_location()
-    check_sso_token(paths)
-    refresh_layer_credentials(paths)
 
 
 # ###########################################################################
@@ -323,6 +309,7 @@ def validate_for_all_commands(layer, skip_validation=False):
 # ###########################################################################
 # BASE COMMAND EXECUTORS
 # ###########################################################################
+@authenticate
 @pass_paths
 @pass_runner
 def _init(tf: TFRunner, paths: PathsHandler, args: Sequence[str], working_dir: Path):
@@ -335,22 +322,15 @@ def _init(tf: TFRunner, paths: PathsHandler, args: Sequence[str], working_dir: P
     )
     init_args = (*filtered_args, f"-backend-config={paths.backend_tfvars}")
 
-    check_sso_token(paths)
-    refresh_layer_credentials(paths)
-
-    if exit_code := tf.run("init", *init_args, working_dir=working_dir):
-        raise Exit(exit_code)
+    tf.run("init", *tf_default_args(), *init_args, working_dir=working_dir)
 
 
+@authenticate
 @pass_paths
 @pass_runner
 def _plan(tf: TFRunner, paths: PathsHandler, args: Sequence[str], working_dir: Path):
     """Generate an execution plan for this layer."""
-    check_sso_token(paths)
-    refresh_layer_credentials(paths)
-
-    if exit_code := tf.run("plan", *tf_default_args(), *args, working_dir=working_dir):
-        raise Exit(exit_code)
+    tf.run("plan", *tf_default_args(), *args, working_dir=working_dir)
 
 
 def has_a_plan_file(args: Sequence[str]) -> bool:
@@ -407,6 +387,7 @@ def has_a_plan_file(args: Sequence[str]) -> bool:
     return True
 
 
+@authenticate
 @pass_paths
 @pass_runner
 def _apply(tf: TFRunner, paths: PathsHandler, args: Sequence[str], working_dir: Path):
@@ -414,33 +395,23 @@ def _apply(tf: TFRunner, paths: PathsHandler, args: Sequence[str], working_dir:
     default_args = () if has_a_plan_file(args) else tf_default_args()
     logger.debug(f"Default args passed to apply command: {default_args}")
 
-    check_sso_token(paths)
-    refresh_layer_credentials(paths)
-
-    if exit_code := tf.run("apply", *default_args, *args, working_dir=working_dir):
-        raise Exit(exit_code)
+    tf.run("apply", *default_args, *args, working_dir=working_dir)
 
 
+@authenticate
 @pass_paths
 @pass_runner
 def _output(tf: TFRunner, paths: PathsHandler, args: Sequence[str], working_dir: Path):
     """Show all output variables of this layer."""
-    check_sso_token(paths)
-    refresh_layer_credentials(paths)
-
-    if exit_code := tf.run("output", *args, working_dir=working_dir):
-        raise Exit(exit_code)
+    tf.run("output", *args, working_dir=working_dir)
 
 
+@authenticate
 @pass_paths
 @pass_runner
 def _destroy(tf: TFRunner, paths: PathsHandler, args: Sequence[str], working_dir: Path):
     """Destroy infrastructure in this layer."""
-    check_sso_token(paths)
-    refresh_layer_credentials(paths)
-
-    if exit_code := tf.run("destroy", *tf_default_args(), *args, working_dir=working_dir):
-        raise Exit(exit_code)
+    tf.run("destroy", *tf_default_args(), *args, working_dir=working_dir)
 
 
 # ###########################################################################

{leverage-2.2.0rc3 → leverage-2.2.0rc5}/leverage/modules/tfautomv.py

@@ -4,28 +4,26 @@ from click.exceptions import Exit
 from leverage._internals import pass_state
 from leverage.modules.runner import Runner
 from leverage.modules.tf import tf_default_args
-from leverage.modules.auth import check_sso_token, refresh_layer_credentials
+from leverage.modules.auth import authenticate
 
 
 @click.command()
 @click.argument("args", nargs=-1)
+@authenticate
 @pass_state
 def tfautomv(state, args):
     """Run TFAutomv commands in the context of the current project.`"""
     tf_default_args_string = " ".join(tf_default_args())
-    credentials_env_vars = {
-        "AWS_SHARED_CREDENTIALS_FILE": str(state.paths.aws_credentials_file),
-        "AWS_CONFIG_FILE": str(state.paths.aws_config_file),
-        "TF_CLI_ARGS_init": tf_default_args_string,
-        "TF_CLI_ARGS_plan": tf_default_args_string,
-    }
+    state.environment["TF_CLI_ARGS_init"] = tf_default_args_string
+    state.environment["TF_CLI_ARGS_plan"] = tf_default_args_string
+
     state.runner = Runner(
         binary="tfautomv",
         error_message=(
             f"TFAutomv not found on system. "
             f"Please install it following the instructions at: https://github.com/busser/tfautomv?tab=readme-ov-file#installation"
         ),
-        env_vars=credentials_env_vars,
+        env_vars=state.environment,
     )
 
     tf_binary = "tofu" if not state.paths.tf_binary else state.paths.tf_binary
@@ -36,8 +34,5 @@ def tfautomv(state, args):
     )
     tfautomv_args = (*filtered_args, f"--terraform-bin={tf_binary}")
 
-    check_sso_token(state.paths)
-    refresh_layer_credentials(state.paths)
-
     if exit_code := state.runner.run(*tfautomv_args):
         raise Exit(exit_code)

{leverage-2.2.0rc3 → leverage-2.2.0rc5}/leverage/modules/tfrunner.py

@@ -2,6 +2,8 @@ import subprocess
 from pathlib import Path
 from typing import Dict, Optional
 
+from click.exceptions import Exit
+
 from leverage._utils import ExitError
 from leverage.modules.runner import Runner
 
@@ -52,7 +54,7 @@ class TFRunner(Runner):
         *args: str,
         env_vars: Optional[Dict[str, str]] = None,
         working_dir: Optional[Path] = None,
-        interactive: bool = True,
+        raises: bool = True,
     ):
         """
         Run the Terraform/OpenTofu binary with the given arguments.
@@ -61,15 +63,20 @@ class TFRunner(Runner):
             *args: Command and arguments to pass (e.g., 'plan', '-out=plan.tfplan')
             env_vars: Environment variables for this specific execution
             working_dir: Working directory for command execution
-            interactive: If True, run interactively. If False, capture output
+            raises: If True, raise an ExitError if the command fails. If False, return the exit code.
 
         Returns:
-            If interactive=True: Exit code (int)
-            If interactive=False: Tuple of (exit_code, stdout, stderr)
+            Exit code (int)
         """
-        return super().run(*args, env_vars=env_vars, working_dir=working_dir, interactive=interactive)
+        return super().run(*args, env_vars=env_vars, working_dir=working_dir, raises=raises)
 
-    def exec(self, *args: str, env_vars: Optional[Dict[str, str]] = None, working_dir: Optional[Path] = None):
+    def exec(
+        self,
+        *args: str,
+        env_vars: Optional[Dict[str, str]] = None,
+        working_dir: Optional[Path] = None,
+        raises: bool = False,
+    ):
         """
         Execute the Terraform/OpenTofu binary in non-interactive mode (captures output).
 
@@ -79,8 +86,9 @@ class TFRunner(Runner):
             *args: Command and arguments to pass (e.g., 'plan', '-out=plan.tfplan')
             env_vars: Environment variables for this specific execution
             working_dir: Working directory for command execution
+            raises: If True, raise an ExitError if the command fails. If False, return the exit code.
 
         Returns:
             Tuple of (exit_code, stdout, stderr)
         """
-        return self.run(*args, env_vars=env_vars, working_dir=working_dir, interactive=False)
+        return super().run(*args, env_vars=env_vars, working_dir=working_dir, interactive=False, raises=raises)

{leverage-2.2.0rc3 → leverage-2.2.0rc5}/leverage/modules/utils.py

@@ -34,13 +34,16 @@ def _handle_subcommand(
         # Run the command directly
         if pre_invocation_callback:
             pre_invocation_callback()
-        if exit_code := runner.run(*args):
-            raise Exit(exit_code)
-
+        exit_code = runner.run(*args)
+        raise Exit(exit_code)
+
+    subcommand = context.command.commands.get(subcommand)
+    # Check that the subcommand arguments are valid
+    subcommand.make_context(
+        info_name=subcommand.name, args=list(args)[args.index(subcommand.name) + 1 :], parent=context
+    )
+    # Invoke wrapped command
+    if not subcommand.params:
+        context.invoke(subcommand)
     else:
-        # Invoke wrapped command
-        subcommand = context.command.commands.get(subcommand)
-        if not subcommand.params:
-            context.invoke(subcommand)
-        else:
-            context.forward(subcommand)
+        context.forward(subcommand)

{leverage-2.2.0rc3 → leverage-2.2.0rc5}/leverage/path.py

@@ -129,7 +129,7 @@ def get_build_script_path(filename="build.py"):
         cur_path = cur_path.parent
 
 
-class PathsHandler:
+class PathsHandler:  # TODO: Turn this class into a something that represents a leverage project
     COMMON_TF_VARS = "common.tfvars"
     ACCOUNT_TF_VARS = "account.tfvars"
     BACKEND_TF_VARS = "backend.tfvars"
@@ -153,6 +153,12 @@ class PathsHandler:
         account_config = self.account_config_dir / self.ACCOUNT_TF_VARS
         self.account_conf = hcl2.loads(account_config.read_text()) if account_config.exists() else {}
 
+        backend_config = self.account_config_dir / self.BACKEND_TF_VARS
+        self.backend_conf = hcl2.loads(backend_config.read_text()) if backend_config.exists() else {}
+
+        # Get MFA enabled status
+        self.mfa_enabled = env_conf.get("MFA_ENABLED", "false")
+
         # Get project name
         self.project = self.common_conf.get("project", env_conf.get("PROJECT", False))
         if not self.project:
@@ -165,23 +171,15 @@ class PathsHandler:
             self.aws_credentials_dir.mkdir(parents=True)
         self.sso_cache = self.aws_credentials_dir / "sso" / "cache"
 
-        # If not empty make the binary path absolute
-        if tf_binary := env_conf.get("TF_BINARY", ""):
-            binary_path = Path(tf_binary)
-            if tf_binary.startswith("~"):
-                self.tf_binary = str(binary_path.expanduser())
-            elif not binary_path.is_absolute() and len(binary_path.parts) > 1:
-                self.tf_binary = str((self.root_dir / tf_binary).resolve())
-            else:
-                self.tf_binary = tf_binary
-
-    def update_cwd(self, new_cwd):
-        self.cwd = new_cwd
-        acc_folder = new_cwd.relative_to(self.root_dir).parts[0]
-
-        self.account_config_dir = self.root_dir / acc_folder / "config"
-        account_config_path = self.account_config_dir / self.ACCOUNT_TF_VARS
-        self.account_conf = hcl2.loads(account_config_path.read_text())
+        # Make the binary path absolute
+        tf_binary = env_conf.get("TF_BINARY", "")
+        binary_path = Path(tf_binary)
+        if tf_binary.startswith("~"):
+            self.tf_binary = str(binary_path.expanduser())
+        elif not binary_path.is_absolute() and len(binary_path.parts) > 1:
+            self.tf_binary = str((self.root_dir / tf_binary).resolve())
+        else:
+            self.tf_binary = tf_binary
 
     @property
     def common_tfvars(self):
@@ -203,6 +201,10 @@ class PathsHandler:
     def aws_credentials_file(self):
         return self.aws_credentials_dir / "credentials"
 
+    @property
+    def aws_cache_dir(self):
+        return self.aws_credentials_dir / "cache"
+
     @property
     def sso_token_file(self):
         return self.sso_cache / "token"
@@ -243,7 +245,7 @@ class PathsHandler:
         if path in (self.root_dir, self.account_dir):
             raise ExitError(
                 1,
-                "This command cannot run neither in the root of the project or in" " the root directory of an account.",
+                "This command cannot run neither in the root of the project or in the root directory of an account.",
             )
 
         if not list(path.glob("*.tf")):

{leverage-2.2.0rc3 → leverage-2.2.0rc5}/pyproject.toml

@@ -1,6 +1,6 @@
 [tool.poetry]
 name = "leverage"
-version = "2.2.0rc3"
+version = "2.2.0rc5"
 description = "Binbash Leverage Command-Line tool."
 authors = ["BinBash Inc <leverage@binbash.com.ar>"]
 license = "MIT"