leflamm / afpre

CLI for the AWS Federation Proxy

Simple script to access the AWS Federation Proxy (AFP). Its main use case is starting a new shell where your temporary AWS credentials have been exported into the environment.

Inspired by https://github.com/ImmobilienScout24/afp-cli

No Expired Tokens

The started bash will notice when the AWS tokens are about to expire. It will then renew the necessary tokens itself. No need to log out and in again.

$ ./afpre 
token expired - need to renew...
authenticating as some.user for some.account/some.role against some.afp.host
done.
AFP| ~/git/hub/afpre$ # do some work ...
AFP| ~/git/hub/afpre$ # typically for an hour or so ...
AFP| ~/git/hub/afpre$ # your tokens have expired ...
token expired - need to renew...
authenticating as some.user for some.account/some.role against some.afp.host
done.
AFP| ~/git/hub/afpre$ # do some more work ...

You can type awsenv to print aws-specific environment information.

Manual Renewal

Whithin an afpre session you can - if you feel the need - manually trigger a token renewal. Either only if your old tokens have expired ...

$ condrenew

... or even unconditionally by calling

$ renew

You can call awsenv to check for your current AWS credentials.

AFP| ~/git/hub/afpre$ awsenv 
AWS_ROLE=admin
AWS_SECRET_ACCESS_KEY=...
AWS_VALID_SECONDS=3600
AWS_ACCOUNT=...
AWS_SESSION_TOKEN=...
AWS_ACCESS_KEY_ID=...
AWS_SECURITY_TOKEN=...

In case you find that condrenew command somewhat useless you got it pretty much right - because that's what afpre does anyway. But since version 0.9.15 both commands are available for subprocesses as well. So even (e. g.) running scripts could trigger their own token renewals.

Run Commands in an afpre Session

You can pass commands to afpre after a separating --. The session will close immediatly after the command has exited. Typically this is very usefull when iterating over accounts and running a command in all of them.

$ ./afpre [OPTIONS] -- <command>

Commands can also be Bash functions. Make sure to export them using export -f <function name> to make them available in the afpre session.

Configuration

$ cat ~/.afpre 
ACCOUNT=<your desired account>
ROLE=<your desired role>
HOST=<your afp host>
_PATH=<your path to service endpoint, typically "/afp-api/latest/account">
NAME=<your username> # optional
PW=<your password> # optional, I wouldn't put it here
PATTERN=\${ACCOUNT}/\${ROLE} # optional, the message you want to see in front of the prompt
RENEW_INT=<custom token renew interval> # optional, defaults to token's expiry
INSECURE=<true|false> # optional, perform "insecure" SSL connections, defaults to false

Use option --example-cfg to create an example configuration file.

Available Packages

See https://github.com/leflamm/afpre/releases

• .deb
• .rpm

afpre's Issues

greedy arg resolution

when using a command passed to afpre, like

afpre --account=xyz -- bash someScriptThatHasAVersionParameter --version=shouldBePassedToScript

afpre recognizes --version as part of the cmdline and exits with its version output:

0.9.9

allow user-set token renew intervall

make installable via homebrew

test - deleteme

support Json output for sourcing credentials with an external process

https://docs.aws.amazon.com/cli/latest/userguide/cli-configure-sourcing-external.html

polish functions

sucks:

• check_dep (consume multiple args
• longoption_value (operate on saved ${@})
• options_contain (same)

make forked bash update its environment itself

vague ideas

• maybe hook into PS1 re-rendering, problem: how to call export in string assignment to variable without forking, $() forks, PS1=$(function_that_renders_and_also_export) would be easy... doesn't help here
• use command substitution $() (still a fork), but manipulate parent shell via gdb... weird sh*t

better ideas

$ cat rc 
PROMPT_COMMAND="export DDD=\$(date)"
$ bash --rcfile rc 
$ env | grep -i ddd
DDD=Mi 24. Mai 22:45:05 CEST 2017
$ env | grep -i ddd
DDD=Mi 24. Mai 22:45:07 CEST 2017
$ env | grep -i ddd
DDD=Mi 24. Mai 22:45:07 CEST 2017
$ env | grep -i ddd
DDD=Mi 24. Mai 22:45:08 CEST 2017

• make actual PROMPT_COMMAND to be conditional on token expiry and perform everything necessary to update the environment, should be possible, see

PROMPT_COMMAND="{
	export DDD=\$(date)
	export UUU=\$(uptime)
}"

• see https://stackoverflow.com/a/3058390/2124712 for another example

help + example cfg

Fix missing usage

RENEW_INT is broken

As soon as RENEW_INT is set, authentication does not work.

add command show aws-specific env

pass command to be run in afpre and return immediatly

export account into environment variable

Export the account into an environment variable, e.g. AFP_ACCOUNT or STAGE.

provide rpms

Date returned null?

Ubuntu 16.04:

afpre x y
** checking dependecies
** reading credentials
username: z
password:
** authenticating as z for x/y against myafphost
** assembling environment
date: invalid date ‘null’
** starting bash

don't use >> to write multi-line files

Enhancement: add support for ~/.afpre

to provide at least defaults for

• account
• role
• afp host
• username
• password (probably controversial)

Reconnecting does not work, or error is not emitted to stdout

AFP| xxx@xxx:~/work/workspaces/github/XXXXX$ 
token expired - need to renew...
authenticating as MYUSERNAME for ACCOUNT/ROLE against MYAFP
done.
AFP| xxx@xxx:~/work/workspaces/github/XXXXX$ 
token expired - need to renew...
authenticating as MYUSERNAME for ACCOUNT/ROLE against MYAFP
done.
AFP| xxx@xxx:~/work/workspaces/github/XXXXX$ 

it keeps renewing. Dunno if it is successful or not, but it seems to loop

provide debs

Not possible to exit afpre when hanging on token renewal

When afpre hangs while renewing the token ("token expired - need to renew..."), it is not possible to exit afpre using ctrl + c:

token expired - need to renew...
authenticating as ... for ... against ...
^C
token expired - need to renew...
authenticating as ... for ... against ...
^C
token expired - need to renew...
authenticating as ... for ... against ...

Instead, it just tries again to renew the token.

Choose between short and detailed prompt prefix

• short (default): AFP| ...
• detailed: $ACCOUNT/$ROLE AFP|...

Do not only provide detailed prompt. Prompt has been like this before - and early users complained :-)

// CC: @nisabek

allow to turn off curl's certificate verification

If you'd like to turn off curl's verification of the certificate, use
the -k (or --insecure) option.

Enhanced prompt resets

Hi
I use [this](bash git prompt ubuntu) to enhance my bash with git status information, but if I use afpre my bash completely resets to the default (OS X) one.

✔ ~/privat/emock [master|✔]
19:16 $ ~/Downloads/afpre-0.9.8/afpre
password:
token expired - need to renew...
AFP| mymac:emock boo$

Any idea why? :)

display how long tokens are valid

support for .profile on os x

:)

make afpre installable using homebrew (brew.sh) tap & document it

I have create a repo here: https://github.com/stweise/homebrew-afpre
to allow installation of afpre using homebrew with very few extra quirks, please see example code block below

stweise@mac-weises:/usr/local$ brew tap stweise/afpre
==> Tapping stweise/afpre
Cloning into '/usr/local/Homebrew/Library/Taps/stweise/homebrew-afpre'...
remote: Enumerating objects: 6, done.
remote: Counting objects: 100% (6/6), done.
remote: Compressing objects: 100% (5/5), done.
remote: Total 6 (delta 0), reused 4 (delta 0), pack-reused 0
Unpacking objects: 100% (6/6), done.
Tapped 1 formula (32 files, 39.8KB).
stweise@mac-weises:~$ brew install stweise/afpre/afpre
==> Installing afpre from stweise/afpre
==> Installing dependencies for stweise/afpre/afpre: oniguruma and jq
==> Installing stweise/afpre/afpre dependency: oniguruma
==> Downloading https://homebrew.bintray.com/bottles/oniguruma-6.9.1.mojave.bottle.tar.gz
==> Downloading from https://akamai.bintray.com/19/1983059c2eae93f1e1ec1bdb65194c64b77182c
######################################################################## 100.0%
==> Pouring oniguruma-6.9.1.mojave.bottle.tar.gz
🍺  /usr/local/Cellar/oniguruma/6.9.1: 17 files, 1.3MB
==> Installing stweise/afpre/afpre dependency: jq
==> Downloading https://homebrew.bintray.com/bottles/jq-1.6.mojave.bottle.1.tar.gz
==> Downloading from https://akamai.bintray.com/71/71f0e76c5b22e5088426c971d5e795fe67abee7
######################################################################## 100.0%
==> Pouring jq-1.6.mojave.bottle.1.tar.gz
🍺  /usr/local/Cellar/jq/1.6: 18 files, 1MB
==> Installing stweise/afpre/afpre
==> Cloning https://github.com/leflamm/afpre.git
Updating /Users/stweise/Library/Caches/Homebrew/afpre--git
==> Checking out tag 0.9.19
HEAD is now at 0009bd0 #39: supersede role
HEAD is now at 0009bd0 #39: supersede role
🍺  /usr/local/Cellar/afpre/0.9.19: 5 files, 19.7KB, built in 2 seconds
stweise@mac-weises:/usr/local$ which afpre
/usr/local/bin/afpre
stweise@mac-weises:/usr/local$ afpre --version
VERSION_PLACEHOLDER
stweise@mac-weises:/usr/local$ brew remove stweise/afpre/afpre
Uninstalling /usr/local/Cellar/afpre/0.9.19... (5 files, 19.5KB)
stweise@mac-weises:/usr/local$ brew untap stweise/afpre
Untapping stweise/afpre...
Untapped 1 formula (33 files, 40.8KB).
stweise@mac-weises:/usr/local$ which afpre
stweise@mac-weises:/usr/local$ 

There are several issues with this solution which would require work on your part.

1. the github username is stweise it should be leflamm as credit should go to you, can you please clone/fork the repo under you username?
2. I fixed the version to 0.9.19 as you do not provide a latest tag and I did not want to point to HEAD of master.
3. as you can see from the output afpre --version returns a placeholder of some sort, can you make that the actual version?
4. it would be nice to have the install (and ideally also removal) instructions visible (README.md, Install.md, ...)

Account name in pattern wrong when using --account switch

When using PATTERN="${ACCOUNT}|${ROLE}" in the config file, and overwriting the account using --account=... on the command line, the PATTERN displays the account which was defined in the config file (and not the overwritten one from the command line).

update environment asynchonously in background

make mac-safe

add debugging switch

shorten prompt

AFP|

supersede role with command line switch

afpre should work with fish shell

Either by checking environment variables, or by configuration, afpre should figure out when it should open a fish shell rather than a bash.

Note that fish has a slightly different syntax.

cannot rely on "which" being present on all distros

authenticating always fails

Hi,

I try to use afpre, but authentication always fails. I use a ! in my password, but it doesn't look like this is the problem. (You can disable the special meaning of ! with $ set +H, but authentication still fails.) Not sure what else could be the problem 🤔

Thanks.