credentor

README

credentor

AWS assume role credential wrapper.

Description

credentor is useful for some commands which couldn't resolve an assume role credentials in ~/.aws/credentials.

For example,

• Terraform
• Packer
• etc.

Install

Place a credentor command to your PATH and set an executable flag.
Download the latest release from github. https://github.com/youyo/credentor/releases/latest

# darwin/amd64
$ curl -s https://api.github.com/repos/youyo/credentor/releases/latest \
	| grep "browser_download_url.*darwin" \
	| cut -d : -f 2,3 \
	| tr -d \" \
	| wget -qi -

# linux/amd64
$ curl -s https://api.github.com/repos/youyo/credentor/releases/latest \
	| grep "browser_download_url.*linux" \
	| cut -d : -f 2,3 \
	| tr -d \" \
	| wget -qi -

Usage

# ~/.aws/credentials

[my-profile]
aws_access_key_id=XXX
aws_secret_access_key=YYY

# ~/.aws/config

[profile foo]
role_arn=arn:aws:iam::999999999999:role/MyRole
source_profile=my-profile

As command wrapper

$ AWS_PROFILE=foo credentor -- some_command [arg1 arg2...]

credentor works as below.

1. Find AWS_PROFILE section in ~/.aws/credentials and ~/.aws/config .
2. Call aws sts assume-role to a get temporary credentials.
3. Set the credentilas to environment variables.
   • AWS_ACCESS_KEY_ID
   • AWS_SECRET_ACCESS_KEY
   • AWS_SESSION_TOKEN
4. Execute some_command with args.

As env exporter

When credentor is executed with no arguments, credentor outputs shell script to export AWS credentials environment variables.

$ export AWS_PROFILE=foo
$ credentor
export AWS_ACCESS_KEY_ID=XXXXXXXXXXXXXXXX
export AWS_SECRET_ACCESS_KEY=zWarBXUtMKJYnC8y4dNAf9e5HQqFTp....
export AWS_SESSION_TOKEN=Wj3YGuSMwn8aJx4AN6TFsbtB5URKHEpVgdDkPvy7....

You can set the credentials in current shell by eval.

$ eval "$(credentor)"

Temporary credentials has expiration time (about 1 hour).

References

credentor is inspired by aswrap.
Original software is aswrap. https://github.com/fujiwara/aswrap

Documentation

Index

• func GetCredentials(arn string, options session.Options) (*credentials.Value, error)
• type Config
  • func NewConfig() *Config
  • func (c *Config) ExportSessionOptions() session.Options
  • func (c *Config) ExtractRoleInfo() error
  • func (c *Config) GetRoleArn() string
• type EnvironmentVariable
• type FilePath
• type RoleInfo

Functions

func GetCredentials

func GetCredentials(arn string, options session.Options) (*credentials.Value, error)

Types

type Config

type Config struct {
	EnvironmentVariables EnvironmentVariable
	FilePaths            FilePath
	Role                 RoleInfo
}

func NewConfig

func NewConfig() *Config

func (*Config) ExportSessionOptions

func (c *Config) ExportSessionOptions() session.Options

func (*Config) ExtractRoleInfo

func (c *Config) ExtractRoleInfo() error

func (*Config) GetRoleArn

func (c *Config) GetRoleArn() string

type EnvironmentVariable

type EnvironmentVariable struct {
	AwsProfile    string
	AwsConfigFile string
}

type FilePath

type FilePath struct {
	AwsConfigFile string
}

type RoleInfo

type RoleInfo struct {
	RoleArn       string
	SourceProfile string
	MfaSerial     string
	ExternalID    string
}