awsmfa

#!/usr/bin/env bash

# Init pyenv and activate awscli virtualenv
# NB: These steps must occur before the pipefail step below due to a bug in pip
if which pyenv > /dev/null; then eval "$(pyenv init -)"; fi
pyenv activate awscli

set -euo pipefail
IFS=$'\n\t'

# Based on https://github.com/lokori/secretman/blob/580c2556ad54ec6f22da854f852f2de775a9e150/awsenv.sh
# This script is designed so that the output is to be evaled, ie
#
# eval $(awsmfa <ROLE>)
#
# where <ROLE> is the name of an aws role.  It assumes that you have ykman
# installed, and that you have configured it to have an oath code, ie
#
# ykman oath add -t aws-<ACCOUNT_NUMBER>-<IAM_USERNAME>
#
# Also assumes that your defaut user has privileges to assume the given role.
#
# XXX Disabled ykman because it isn't working on MacOS

if [[ $# -ge 1 ]]; then
    ROLE="$1"
else
    (>&2 echo "ERROR: Please provide aws profile as argument.")
    exit -1
fi

CALLER_IDENTITY=($(aws sts get-caller-identity --output text))


AWS_ACCOUNT_NUMBER="${CALLER_IDENTITY[0]}"
AWS_IAM_USER_ARN="${CALLER_IDENTITY[1]}"
AWS_IAM_USERNAME="$(basename "$AWS_IAM_USER_ARN")"
MFA_SERIAL="arn:aws:iam::$AWS_ACCOUNT_NUMBER:mfa/$AWS_IAM_USERNAME"

# TOKEN_CODE=$(ykman oath code -s "aws-$AWS_ACCOUNT_NUMBER-$AWS_IAM_USERNAME")
read -p 'Enter MFA code: ' TOKEN_CODE
PROFILE_INFO=($(aws sts assume-role \
                --role-arn "arn:aws:iam::$AWS_ACCOUNT_NUMBER:role/$ROLE" \
                --serial-number "$MFA_SERIAL" \
                --role-session-name "$AWS_IAM_USERNAME" \
                --token-code "$TOKEN_CODE" \
                --query 'Credentials.[AccessKeyId,SecretAccessKey,SessionToken]' \
                --output text))

echo export AWS_ACCESS_KEY_ID="${PROFILE_INFO[0]}" \
    AWS_SECRET_ACCESS_KEY="${PROFILE_INFO[1]}" \
    AWS_SESSION_TOKEN="${PROFILE_INFO[2]}"