m-radzikowski / omf-plugin-asp

Oh My Fish plugin for switching between AWS profiles.

asp

A plugin for Oh My Fish.

Enables quick switching between AWS profiles.

Prerequisites

• AWS CLI
• jq
• AWK

Install

omf install [email protected]:mgoodness/plugin-asp.git

Usage

Set profile

asp <aws_profile> [region]

asp - AWS Set Profile

Sets $AWS_PROFILE and $AWS_DEFAULT_PROFILE variables.
The optional region value can be used if you wish to override the default region configured for the profile.

Get selected profile

agp

agp - AWS Get Profile

Echoes $AWS_PROFILE and $AWS_DEFAULT_REGION.

Clear selected profile

acp

acp - AWS Clear Profile

Clears variables for selected profile and assumed role.

Assume role

aar <role_arn>

aar - AWS Assume Role

Performs STS Assume Role call and sets obtained $AWS_ACCESS_KEY_ID, $AWS_SECRET_ACCESS_KEY and $AWS_SESSION_TOKEN variables.

To clear assumed role variables execute either acp or asp command.

License

MIT © Michael Goodness et al

omf-plugin-asp's Issues

Setting just AWS_PROFILE and using ~/.aws/config file

This is a very useful plugin, a must-have for AWS developers. But I found using it much more obstructive than it's zsh counterpart: https://github.com/ohmyzsh/ohmyzsh/blob/master/plugins/aws/aws.plugin.zsh

The problem

From what I see this plugin reads ~/.aws/configuration file to extract credentials and performs sts assume-role call to set AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY and AWS_SESSION_TOKEN. This has a drawback of role-based credentials expiration after an hour, like it's mentioned in the readme.

But more important is that according to AWS docs the proper configuration should look like this (see https://docs.aws.amazon.com/cli/latest/topic/config-vars.html and https://docs.aws.amazon.com/credref/latest/refdocs/setting-global-source_profile.html):

# In ~/.aws/credentials:
[development]
aws_access_key_id=foo
aws_secret_access_key=bar

# In ~/.aws/config
[profile crossaccount]
role_arn=arn:aws:iam:...
source_profile=development

Right now having this configuration will result in asp error Invalid ... profile in ...

Probably the same case will be when using SSO in AWS CLI v2 (although I cannot confirm this).

The proposition

Simplify the plugin behaviour by just setting AWS_PROFILE (and AWS_DEFAULT_PROFILE for compatibility). Look for profile names in ~/.aws/config file. This will make the plugin work more like mentioned before zsh version.

@mgoodness what do you think? If you agree I can create PR with changes. Otherwise, please let me know you do not want such changes here and I probably will release this as a separate plugin.

AWS_DEFAULT_PROFILE vs AWS_PROFILE

It seems that while the environment variable used to be named AWS_DEFAULT_PROFILE the documentation now states it's AWS_PROFILE.

See https://docs.aws.amazon.com/cli/latest/userguide/cli-environment.html and https://onetechnical.wordpress.com/2016/10/07/the-curious-case-of-aws_default_profile/

So while AWS_DEFAULT_PROFILE might also work, it seems better to update it to the current standard.