joshcarter-ops / aws-account-switcher

Utility to switch aws accounts on the fly

AWS Account Switcher

### WARNING ###
Make a backup of your .aws/credentials folder before using this utility!
Also the default rotation time is 30 days!

Repository to allow you to switch to various AWS Accounts, rotate your access keys and assume roles on the command line without the need of exporting those pesky bash env vars!

Components

• switcher.py
• profiles.json

What to do?

1. Create a profiles.json in the project for yourself (copy/rename the profiles_example.json)
2. Update the values for the accounts you wish to switch to (home, work, nonprod, prod etc.)
3. Run using python3 switcher.py

Why?

This script was written to enable read only users to assume a role to run cli commands that they normally wouldn't have permissions to do. The script since then has developed into a auto key rotator and account switcher. This was initially written by myself for the developers where I work, it was suggested that I open source it because 'it's a nightmare switching accounts/roles manually!'.

profiles.json example

{
  "profiles": [
    {
      "type": "personal",
      "role": "role",
      "account_number": "0011223344",
      "username": "[email protected]",
      "aws_access_key_id": "PERSONALACCESSKEY",
      "aws_secret_access_key": "PERSONALSECRETACCESSKEY",
      "mfa": "arn:aws:iam::0011223344:mfa/[email protected]",
      "duration": ""
    },
    {
      "type": "work",
      "role": "role",
      "account_number": "0011223355",
      "username": "[email protected]",
      "aws_access_key_id": "WORKACCESSKEY",
      "aws_secret_access_key": "WORKSECRETACCESSKEY",
      "mfa": "arn:aws:iam::0011223355:mfa/[email protected]",
      "duration": ""
    }
  ]
}

aws-account-switcher's Issues

When running script with 2 access keys set profile.json is cleared

I think this might be a niche bug but if I have two access keys set and run the script it throws a "Cannot exceed quota for AccessKeysPerUser: 2" error but then removes the contents of profiles.json. I think it might be a good idea to check for the key quota before running any code. I'm happy to create an MR to solve this issue.

Here is the error:

An error occurred (LimitExceeded) when calling the CreateAccessKey operation: Cannot exceed quota for AccessKeysPerUser: 2 Traceback (most recent call last): File "switcher.py", line 150, in <module> rotate_keys() File "switcher.py", line 94, in rotate_keys new_key = json.loads(bash('aws iam create-access-key --user-name {}'.format(username)))['AccessKey'] File "/usr/lib/python3.6/json/__init__.py", line 354, in loads return _default_decoder.decode(s) File "/usr/lib/python3.6/json/decoder.py", line 339, in decode obj, end = self.raw_decode(s, idx=_w(s, 0).end()) File "/usr/lib/python3.6/json/decoder.py", line 357, in raw_decode raise JSONDecodeError("Expecting value", s, err.value) from None json.decoder.JSONDecodeError: Expecting value: line 1 column 1 (char 0)