nate2-scripts 2.0.0__tar.gz → 2.0.1__tar.gz

nate2_scripts-2.0.1/PKG-INFO

@@ -0,0 +1,221 @@
+Metadata-Version: 2.5
+Name: nate2-scripts
+Version: 2.0.1
+Summary: Utility scripts for AWS development on macOS
+Project-URL: Homepage, https://github.com/tennex-nwestfall/nate2-scripts
+License-File: LICENSE
+Requires-Python: >=3.11
+Requires-Dist: argcomplete
+Requires-Dist: boto3
+Provides-Extra: dev
+Requires-Dist: boto3-stubs[essential]; extra == 'dev'
+Requires-Dist: moto[all]; extra == 'dev'
+Requires-Dist: pytest; extra == 'dev'
+Description-Content-Type: text/markdown
+
+[![PyPI version](https://img.shields.io/pypi/v/nate2-scripts)](https://pypi.org/project/nate2-scripts/)
+[![License](https://img.shields.io/github/license/tennex-nwestfall/nate2-scripts)](https://github.com/tennex-nwestfall/nate2-scripts/blob/main/LICENSE)
+
+# Nate2's Scripts
+
+Utility scripts for AWS development on macOS.
+
+To install run:
+
+```bash
+pip install nate2-scripts
+```
+
+To update run:
+
+```bash
+pip install --upgrade nate2-scripts
+```
+
+## Scripts
+
+### `console`
+
+Opens the AWS Management Console in your browser for a specific service, ARN, resource id, or resource name, using federated sign-in from your current AWS credentials. Supports multi-session via searching browser history sqlite databases.
+
+**Requirements:**
+
+- `AWS_PROFILE` set (e.g. via `asp`)
+- `git config user.email` set — it is used as the `role_session_name` for every assume-role profile
+
+**Example Alias:**
+
+```bash
+# noglob is so that one can paste in logs arns that end with :*
+# otherwise zsh tries to see the log arn as a glob and fails
+alias co="noglob console"
+# needed for autocomplete
+eval "$(register-python-argcomplete console)"
+```
+
+**Usage:**
+
+```bash
+console [service | arn | id | name] [search ...] [-r REGION] [-f]
+```
+
+```bash
+# change to an account/role
+asp my-aws-role
+
+# open main page of the role/account
+console
+# open ec2 page of the role/account
+console ec2
+# open lambda page of the role/account in us-west-2
+console lambda -r us-west-2
+# open a service page filtered by search terms (multiple words are joined)
+console lambda my-function
+console logs /aws/lambda/my
+console cf my stack
+# open instance id page of the role/account in
+# whatever region that instance is in
+console i-0123456789abcdef
+# open an S3 bucket, prefix, or object
+console s3://my-bucket/some/prefix/
+# open a resource by name (log group, S3 bucket, EC2 Name tag,
+# CloudFormation stack, or Lambda function)
+console my-function
+# open the console page for the resource the ARN points to
+console arn:aws:ec2:us-east-1:012345678967:instance/i-0123456789abcdef
+# force a new federated sign-in (resets the session cache)
+console -f
+```
+
+**Options:**
+
+| Flag                    | Description                                                       |
+| ----------------------- | ----------------------------------------------------------------- |
+| `-r`, `--region <name>` | Region to open the console in; also added to the searched regions |
+| `-f`, `--force`         | Reset the session cache and force a new federated sign-in         |
+
+**Resolution order:**
+
+1. **ARN** — if the first argument parses as an ARN
+2. **Service** — if the first argument is a known service name or alias
+3. **Resource id** — if the first argument matches a known id pattern
+4. **Resource name** — looked up in parallel across all name-resolving services; the first match in priority order wins: CloudWatch log group → S3 bucket → EC2 `Name` tag → CloudFormation stack → Lambda function
+
+**Supported services** (aliases after the `/`):
+
+| Service                | Names                                     | Search terms |
+| ---------------------- | ----------------------------------------- | ------------ |
+| API Gateway            | `apigateway` / `api`                      |              |
+| Artifact               | `artifact`                                |              |
+| Athena                 | `athena`                                  |              |
+| Batch                  | `batch` / `job` / `jobs`                  |              |
+| Bedrock                | `bedrock` / `br`                          |              |
+| CloudFormation         | `cloudformation` / `cf`                   | ✓            |
+| CloudFront             | `cloudfront` / `front`                    |              |
+| CloudHSM               | `cloudhsm` / `hsm`                        |              |
+| CloudTrail             | `cloudtrail` / `ct`                       |              |
+| CloudWatch             | `cloudwatch` / `cw`                       |              |
+| CloudWatch Logs        | `logs`                                    | ✓            |
+| Cognito                | `cognito` / `cn`                          |              |
+| Config                 | `config` / `cfg`                          |              |
+| Control Tower          | `controltower`                            |              |
+| Cost Management        | `cost`                                    |              |
+| DataSync               | `datasync` / `ds`                         |              |
+| DynamoDB               | `dynamodb` / `dynamo` / `dyn`             |              |
+| EC2 instances          | `ec2`                                     | ✓            |
+| EC2 AMIs (owned by me) | `ami`                                     | ✓            |
+| ECR                    | `ecr` / `docker`                          |              |
+| ECS                    | `ecs` / `cluster` / `task` / `tasks`      |              |
+| EFS                    | `efs`                                     |              |
+| EKS                    | `eks`                                     |              |
+| Elastic Beanstalk      | `elasticbeanstalk` / `bean`               |              |
+| Elastic Load Balancing | `elb` / `alb`                             |              |
+| EventBridge            | `eventbridge` / `eb`                      |              |
+| FSx                    | `fsx`                                     |              |
+| Glue                   | `glue`                                    |              |
+| GuardDuty              | `guardduty` / `guard`                     |              |
+| IAM                    | `iam`                                     |              |
+| Inspector              | `inspector`                               |              |
+| KMS                    | `kms`                                     |              |
+| Lambda                 | `lambda`                                  | ✓            |
+| Lex                    | `lex`                                     |              |
+| Lightsail              | `lightsail` / `ls`                        |              |
+| Marketplace            | `marketplace` / `market` / `tennex`       | ✓            |
+| Polly                  | `polly`                                   |              |
+| RDS                    | `rds`                                     |              |
+| Route 53               | `route53` / `53`                          |              |
+| S3                     | `s3`                                      |              |
+| SageMaker              | `sagemaker` / `sage`                      |              |
+| Scheduler              | `scheduler` / `sch`                       |              |
+| Secrets Manager        | `secretsmanager` / `secretmanager` / `sm` |              |
+| Security groups        | `sg`                                      | ✓            |
+| SNS                    | `sns`                                     |              |
+| SQS                    | `sqs`                                     |              |
+| Step Functions         | `step`                                    |              |
+| Storage Gateway        | `storagegateway` / `sgw`                  |              |
+| Support                | `support`                                 |              |
+| Systems Manager        | `ssm`                                     |              |
+| SSM Parameter Store    | `parameter` / `ps`                        | ✓            |
+| VPC                    | `vpc`                                     |              |
+| VPC subnets            | `subnet`                                  |              |
+| VPC network ACLs       | `acl` / `nacl`                            |              |
+| VPC Elastic IPs        | `elasticip` / `eni`                       |              |
+| VPC route tables       | `routetable` / `routes`                   |              |
+| VPC internet gateways  | `internetgateway` / `internet` / `igw`    |              |
+| VPC NAT gateways       | `nat`                                     |              |
+| VPC endpoints          | `endpoints` / `end`                       |              |
+| VPC transit gateways   | `transitgateway` / `transit` / `tgw`      |              |
+
+`tennex` opens a Marketplace search for "tennex". Cost Management and Marketplace always open in `us-east-1`.
+
+**Supported resource ids:** `i-*` (EC2 instance), `sg-*` (security group), `ami-*`, `lt-*` (launch template), `vol-*` (EBS volume), `snap-*` (EBS snapshot), `eni-*` (network interface), `s3://bucket[/key]`
+
+**Supported ARNs:** `ec2` (instance), `lambda` (function), `logs` (log group, log stream), `s3` (bucket, prefix, object)
+
+**Cross-account ARNs:** if an ARN's account differs from the current one, `console` switches to the first profile in your AWS config whose `role_arn` is in that account.
+
+**Regions:** ids and names are searched across `us-east-1`, `us-east-2`, `us-west-1`, and `us-west-2`, plus the region passed with `-r`.
+
+**Session cache:** federated session hashes are cached per profile for 59 minutes in `$XDG_STATE_HOME/console-sessions.json` (default `~/.local/state/console-sessions.json`). Use `-f` to reset it.
+
+---
+
+### `bing-wrapper`
+
+A PTY wrapper that runs any command in a pseudo-terminal and plays a macOS system sound when a configurable output pattern is detected, and/or when the command finishes. Useful for long-running CLI tools (e.g. CDK deployments) that prompt for confirmation or take a while to complete.
+
+**Requirements:** None
+
+**Example Alias Usage:**
+
+```bash
+# wraps cdk to play Frog.aiff when done and play Glass.aiff (default) on "(y/n)" prompts
+alias cdk="bing-wrapper --end --pattern \"(y/n)\" --sound-end /System/Library/Sounds/Frog.aiff -- cdk"
+
+# wraps nextflow to play a sound when done
+alias nextflow="bing-wrapper --end -- nextflow"
+
+# needed for autocomplete of bing-wrapper and the inner command
+eval "$(bing-wrapper --autocomplete)"
+```
+
+**Options:**
+
+| Flag                     | Description                                               | Default      |
+| ------------------------ | --------------------------------------------------------- | ------------ |
+| `--end`                  | Play a sound when the command exits                       | off          |
+| `--pattern <text>`       | Play a sound when `<text>` appears in output (repeatable) | none         |
+| `--sound-end <path>`     | Sound file to play on exit                                | `Glass.aiff` |
+| `--sound-pattern <path>` | Sound file to play on pattern match                       | `Glass.aiff` |
+| `--sound-while <path>`   | Sound file to play on loop while the command runs         | none         |
+
+---
+
+## Development
+
+```bash
+pip install -e ".[dev]"
+pytest
+```
+
+Resolver tests live in `tests/console/resolvers/`, one module per service, and use `moto` to mock AWS.

{nate2_scripts-2.0.0 → nate2_scripts-2.0.1}/README.md

@@ -105,6 +105,7 @@ console -f
 | Config                 | `config` / `cfg`                          |              |
 | Control Tower          | `controltower`                            |              |
 | Cost Management        | `cost`                                    |              |
+| DataSync               | `datasync` / `ds`                         |              |
 | DynamoDB               | `dynamodb` / `dynamo` / `dyn`             |              |
 | EC2 instances          | `ec2`                                     | ✓            |
 | EC2 AMIs (owned by me) | `ami`                                     | ✓            |
@@ -130,6 +131,7 @@ console -f
 | Route 53               | `route53` / `53`                          |              |
 | S3                     | `s3`                                      |              |
 | SageMaker              | `sagemaker` / `sage`                      |              |
+| Scheduler              | `scheduler` / `sch`                       |              |
 | Secrets Manager        | `secretsmanager` / `secretmanager` / `sm` |              |
 | Security groups        | `sg`                                      | ✓            |
 | SNS                    | `sns`                                     |              |

{nate2_scripts-2.0.0 → nate2_scripts-2.0.1}/pyproject.toml

@@ -4,8 +4,9 @@ build-backend = "hatchling.build"
 
 [project]
 name = "nate2-scripts"
-version = "2.0.0"
+version = "2.0.1"
 description = "Utility scripts for AWS development on macOS"
+readme = "README.md"
 requires-python = ">=3.11"
 dependencies = [
     "argcomplete",

{nate2_scripts-2.0.0 → nate2_scripts-2.0.1}/src/nate2_scripts/console/__init__.py

@@ -194,7 +194,7 @@ def main() -> None:
     print("Default region is: ", session.region_name)
 
     suffix, context = get_suffix(args.service, args.search, args.region, session)
-    if suffix:
+    if suffix is not None:
         open_console(suffix, context, session_cache)
     else:
         print("Cannot open console page.")

nate2_scripts-2.0.1/src/nate2_scripts/console/resolvers/datasync.py

@@ -0,0 +1,11 @@
+from nate2_scripts.console.resolvers import Context, Resolver
+
+
+class DataSyncResolver(Resolver):
+    def get_service_names(self) -> list[str]:
+        return ["datasync", "ds"]
+
+    def try_resolve_service(
+        self, context: Context, service: str, search: str
+    ) -> str | None:
+        return "/datasync/home#/tasks"

nate2_scripts-2.0.1/src/nate2_scripts/console/resolvers/scheduler.py

@@ -0,0 +1,11 @@
+from nate2_scripts.console.resolvers import Context, Resolver
+
+
+class SchedulerResolver(Resolver):
+    def get_service_names(self) -> list[str]:
+        return ["scheduler", "sch"]
+
+    def try_resolve_service(
+        self, context: Context, service: str, search: str
+    ) -> str | None:
+        return "/scheduler/home#schedules"

{nate2_scripts-2.0.0 → nate2_scripts-2.0.1}/src/nate2_scripts/console/text_resolver.py

@@ -16,6 +16,7 @@ from nate2_scripts.console.resolvers.cognito import CognitoResolver
 from nate2_scripts.console.resolvers.config import ConfigResolver
 from nate2_scripts.console.resolvers.controltower import ControlTowerResolver
 from nate2_scripts.console.resolvers.cost import CostResolver
+from nate2_scripts.console.resolvers.datasync import DataSyncResolver
 from nate2_scripts.console.resolvers.dynamo import DynamoResolver
 from nate2_scripts.console.resolvers.ec2 import Ec2Resolver
 from nate2_scripts.console.resolvers.ecr import EcrResolver
@@ -41,6 +42,7 @@ from nate2_scripts.console.resolvers.rds import RdsResolver
 from nate2_scripts.console.resolvers.route53 import Route53Resolver
 from nate2_scripts.console.resolvers.s3 import S3Resolver
 from nate2_scripts.console.resolvers.sagemaker import SagemakerResolver
+from nate2_scripts.console.resolvers.scheduler import SchedulerResolver
 from nate2_scripts.console.resolvers.secretsmanager import SecretsManagerResolver
 from nate2_scripts.console.resolvers.sns import SnsResolver
 from nate2_scripts.console.resolvers.sqs import SqsResolver
@@ -73,6 +75,7 @@ RESOLVERS: list[Resolver] = [
     ConfigResolver(),
     ControlTowerResolver(),
     CostResolver(),
+    DataSyncResolver(),
     DynamoResolver(),
     EcrResolver(),
     EcsResolver(),
@@ -94,6 +97,7 @@ RESOLVERS: list[Resolver] = [
     RdsResolver(),
     Route53Resolver(),
     SagemakerResolver(),
+    SchedulerResolver(),
     SecretsManagerResolver(),
     SnsResolver(),
     SqsResolver(),

{nate2_scripts-2.0.0 → nate2_scripts-2.0.1}/tests/console/resolvers/__init__.py

@@ -3,6 +3,7 @@ from pathlib import Path
 import boto3
 import pytest
 
+from nate2_scripts.console import get_suffix
 from nate2_scripts.console.resolvers import Arn
 from nate2_scripts.console.text_resolver import RESOLVERS
 
@@ -27,3 +28,16 @@ def test_resolver_has_test_file(resolver):
     assert (TEST_DIR / f"{module_name}.py").is_file(), (
         f"{type(resolver).__name__} has no tests/console/resolvers/{module_name}.py"
     )
+
+
+def test_base():
+    session = make_session("fake-A-org")
+    suffix, context = get_suffix(
+        "",
+        "this parameter isn't possible",
+        "",
+        session,
+    )
+    assert suffix == ""
+    assert context.session.region_name == "us-east-1"
+    assert context.identity["Account"] == "111111111111"

nate2_scripts-2.0.1/tests/console/resolvers/datasync.py

@@ -0,0 +1,34 @@
+from nate2_scripts.console import get_suffix
+from tests.console.resolvers import make_session
+
+DATASYNC_CONSOLE_URL = "/datasync/home#/tasks"
+
+# --------------------------------
+# Service
+# --------------------------------
+
+
+def test_service_datasync():
+    session = make_session("fake-A-org")
+    suffix, context = get_suffix(
+        "datasync",
+        "this parameter doesn't matter",
+        "",
+        session,
+    )
+    assert suffix == f"{DATASYNC_CONSOLE_URL}"
+    assert context.session.region_name == "us-east-1"
+    assert context.identity["Account"] == "111111111111"
+
+
+def test_service_ds():
+    session = make_session("fake-A-org")
+    suffix, context = get_suffix(
+        "ds",
+        "this parameter doesn't matter",
+        "us-west-2",
+        session,
+    )
+    assert suffix == f"{DATASYNC_CONSOLE_URL}"
+    assert context.session.region_name == "us-west-2"
+    assert context.identity["Account"] == "111111111111"

nate2_scripts-2.0.1/tests/console/resolvers/scheduler.py

@@ -0,0 +1,34 @@
+from nate2_scripts.console import get_suffix
+from tests.console.resolvers import make_session
+
+SCHEDULER_CONSOLE_URL = "/scheduler/home#schedules"
+
+# --------------------------------
+# Service
+# --------------------------------
+
+
+def test_service_scheduler():
+    session = make_session("fake-A-org")
+    suffix, context = get_suffix(
+        "scheduler",
+        "this parameter doesn't matter",
+        "",
+        session,
+    )
+    assert suffix == f"{SCHEDULER_CONSOLE_URL}"
+    assert context.session.region_name == "us-east-1"
+    assert context.identity["Account"] == "111111111111"
+
+
+def test_service_sch():
+    session = make_session("fake-A-org")
+    suffix, context = get_suffix(
+        "sch",
+        "this parameter doesn't matter",
+        "us-west-2",
+        session,
+    )
+    assert suffix == f"{SCHEDULER_CONSOLE_URL}"
+    assert context.session.region_name == "us-west-2"
+    assert context.identity["Account"] == "111111111111"

nate2_scripts-2.0.0/CONSOLE-NOTES.md

@@ -1,70 +0,0 @@
-# Console Script — Session Investigation Notes
-
-## The Problem
-
-Running `co lambda` then `co ec2` (same account) signs out the Lambda tab.
-
-## Root Cause
-
-The session cache keys by `AccessKeyId`, which rotates every time Okta refreshes STS credentials (~1 hour). After rotation, the cache misses and re-federates, creating a new browser session that invalidates the previous one.
-
-## How Federation Works
-
-1. CLI credentials (AccessKeyId/SecretAccessKey/SessionToken) are sent to `signin.aws.amazon.com/federation?Action=getSigninToken` → returns a one-time SigninToken
-2. Browser opens `signin.aws.amazon.com/federation?Action=login&SigninToken=...` → AWS creates a browser console session (cookies) and redirects to destination
-3. The browser session lasts **12 hours** (script uses 11hr buffer)
-4. Each `Action=login` call for the **same account** replaces the previous session → other tabs for that account become invalid
-5. Different accounts get isolated sessions (multi-session console, 2024+) — no conflict
-
-## Key Findings
-
-- **Federation does NOT require existing browser cookies** — it creates a session from scratch using CLI creds
-- **Multi-session console** isolates different accounts but NOT multiple sessions within the same account
-- **Re-federating same account** kills existing tabs for that account
-- **The account-specific URL hash** (e.g., `lh2nfmmd` in `905502466771-lh2nfmmd.us-east-1.console.aws.amazon.com`) is per-browser-session, changes on every sign-in, and is NOT retrievable via any AWS API. It's assigned client-side by JavaScript after login.
-- **The hash is NOT cacheable** — it's tied to the browser session lifetime, not the account
-- **DNS lookups** won't help — `*.console.aws.amazon.com` is a wildcard record; the hash is resolved by cookies/frontend
-
-## The Fix
-
-Key the session cache by **profile name** (or account ID) instead of `AccessKeyId`:
-
-- The browser session is tied to the account, not the specific credential set
-- Even after Okta rotates creds (new AccessKeyId), the browser session from the previous federation is still alive
-- Cache should prevent re-federation as long as it's within 11 hours of the last federation for that profile
-
-## Approaches Considered & Rejected
-
-| Approach | Why rejected |
-|----------|-------------|
-| Always federate | Signs out other tabs for same account |
-| Account-specific URL hash (cached) | Hash is per-session, not stable |
-| Selenium/Playwright to discover hash | Hash from WebDriver session ≠ real browser session |
-| AppleScript to read browser URL | Hash is session-bound, same lifecycle as session cache |
-| Browser profiles (Chrome/Firefox) | Still can't open 2nd tab without re-federation within same profile |
-| DNS lookup for hash | Wildcard DNS — hash is cookie-routed, not DNS-routed |
-| Capture hash from federation redirect | Redirect goes to the generic URL; hash rewrite is client-side JS |
-
-## Current Architecture
-
-```
-co <service>
-  → check AWS_PROFILE is set
-  → parse destination URL
-  → get CLI creds (aws configure export-credentials)
-  → check session cache
-    → valid: open raw URL (webbrowser.open)
-    → expired/missing: federate → open federation URL → record cache
-```
-
-## What Needs to Change
-
-```python
-# Before (buggy): keyed by AccessKeyId which rotates
-cache[creds["AccessKeyId"]] = {"federated_at": time.time()}
-
-# After: keyed by profile name which is stable
-cache[profile_name] = {"federated_at": time.time()}
-```
-
-This ensures that within the 11-hour window, `co` opens the raw URL without re-federating, keeping other same-account tabs alive.

nate2_scripts-2.0.0/PKG-INFO

@@ -1,13 +0,0 @@
-Metadata-Version: 2.5
-Name: nate2-scripts
-Version: 2.0.0
-Summary: Utility scripts for AWS development on macOS
-Project-URL: Homepage, https://github.com/tennex-nwestfall/nate2-scripts
-License-File: LICENSE
-Requires-Python: >=3.11
-Requires-Dist: argcomplete
-Requires-Dist: boto3
-Provides-Extra: dev
-Requires-Dist: boto3-stubs[essential]; extra == 'dev'
-Requires-Dist: moto[all]; extra == 'dev'
-Requires-Dist: pytest; extra == 'dev'