marceloboeira/awsudo

> sudo-like behavior for role assumed access on AWS accounts

sudo-like behavior for role assumed access on AWS accounts

What does it do?

The AWS sudo, inject aws credentials to the command you want to run:

awsudo -u staging env | grep AWS

Results in:

AWS_SESSION_TOKEN=********
AWS_SECRET_ACCESS_KEY=**************
AWS_ACCESS_KEY_ID=********

Notice - awsudo was meant for local usage, it is not for server authentication.

See the Motivation section for more info.

Workflow

This is how the CLI works under the hood:

(click to see the large version)

Setup

It is assumed that you have awscli installed and configured OR at least, the ~/.aws/config file following this pattern:

[profile foo]
role_arn=...
mfa_serial=... (if necessary)
region=...

More information: https://docs.aws.amazon.com/cli/latest/userguide/cli-configure-profiles.html

macOS

brew tap marceloboeira/formulas
brew install marceloboeira/formulas/awsudo

Usage

awsudo - sudo-like behavior for role assumed access on AWS accounts 0.1.1

USAGE:
    awsudo [OPTIONS] --user <user> [SUBCOMMAND]

FLAGS:
    -h, --help       Prints help information
    -V, --version    Prints version information

OPTIONS:
        --cache-dir <DIR>    Custom directory for credentials caching, defaults to ~/.awsudo/
    -c, --config <FILE>      Custom config file, defaults to: ~/.aws/config
    -u, --user <user>        AWS profile name based on the config file

Thanks clap for that.

Examples

Get all of the S3 buckets of the production account:

awsudo -u production aws s3 ls

Run a executable that needs AWS credentials:

awsudo -u staging delete_s3_buckets "s3://staging-acc/foo"

Aliases

This is not required, but interesting:

alias awss='awsudo -u staging'
alias awso='awsudo -u operations'
alias awsp='awsudo -u production'

Then after:

awss [subcomand]

Motivation

Main motivation was to write something that I would use everyday with rust, the awsudo usecase was quite interesting. The original awsudo is heavily used where I work and it constantly causes pain, the CLI has a couple of issues:

1. Distribution - It was written in Python, which makes it difficult to distribute, also doens't have a homebrew formula
2. Dependencies - It locks the aws-cli version, and depends on code of the CLI itself
3. Versioning - It doesn't have versions whatsoever
4. Bugs - It has a couple of bugs, e.g.: you can't pass AWS_* like variables to your command

The official solution from AWS is not really great either:

1. Stateful - Once you assume you stick with it until it expires or you switch
2. CLI centric - Hard to share the credentials and switch quickly if you are not using their CLI

awsudo's Issues

[Epic] Split & Test

Start extracting, abstracting and testing. I don't know exactly how I'll do that, but I want to have some parts as independent modules so that it's easier to test and compose/change if needed.

• CLI - Parses the CLI command to trigger other modules
• Config - Loads the config from ~/.aws/credentials ...
• State Controller - Looks at the current state based on Config and figure what to do (takes care of caching, triggering command runner, token generator and such)
• Command Runner - Run the command with the injected variables (ENV)
• Token Generator - Receives information about the profile and return the token

Properly support NO MFA profiles

Improve #1

Force new STS Token generation

Make it possible to force / purge the cache

e.g.:
awsudo -u production --force ... -> forces the token generation

Setup Integration Tests?

Sort of hard at this point, since there is no "docker-image" for AWS STS, it would have to be a REAL account structure, with some ROLE authorisation configured...

Might be something nice to do with terraform.

Get STS Token expiration from Response

AWS allows us to get the STS expiration timestamp from the response, at this point we just assume 1 hour and use that hardcoded all around.

More info:
https://docs.aws.amazon.com/STS/latest/APIReference/API_GetSessionToken.html

Pipe & stdin

It's often necessary to use unix pipes with awsudo credentials injection...

cat foo.csv | awsudo -u staging s3_uploader

where s3_uploader is a binary that takes stdin and stream upload to S3.

Automatically expire STS after lifetime

Make sure to cache the token only during its life time...

Store the session during its valid period

Store the tokens while they are valid

Handle errors gracefully

Right now, errors are not handled in a way...

$ awsudo -u invalid echo bar
thread 'main' panicked at 'Profile not found', src/main.rs:34:27
note: Run with `RUST_BACKTRACE=1` environment variable to display a backtrace.

it would be better to use something like:

$ awsudo -u invalid echo bar
Error: Profile not found

wrong profile parsing from ~/.aws/config

According to the docs here (and the behavior of the aws-cli tool), the profiles, ie. the section names in the ~/.aws/config file should be prefixed with "profile", for example:

[profile user1]
region=us-east-1
output=text

while awsudo, expects it to be just [user1].

Support source_profile to specify which profile to get the credentials from

aws-cli supports a source_profile option in the config file which specifies which profile to get the credentials from. I actually don't have a [default] section in my ~/.aws/credentials file, so that a random aws command would fail to do anything. All my profiles explicitly specify where to get the credentials from.

Some examples here:
https://docs.aws.amazon.com/cli/latest/userguide/cli-configure-role.html

ps.
When I have time, I'll take a look at implementing this. unless someone beats me to it.

Non-intrusive MFA token collection

At this moment, we use stdin/out to both print the Please type your MFA token... and collect the MFA token. That can be intrusive to users that might want to pipe/redirect its output:

awsudo -u production read_consul_logs > logs.txt

If an MFA token needs to be collected, the file output will include the printed stdin:

Please type your MFA token for arn:aws:iam::9999999999:user/bezos: 

MY LOGS

Therefore, we might be better served using /dev/tty.

Reference:

• marceloboeira/confirm-before@372415f

Release compilation

Figure how to:

• Compile Rust for Production macOS (with Cargo?)
• Integrate that into the release process with Github (new GitHub Actions?)

Make it possible to send command without quotes

Find a way you can use:

awsudo -u production aws s3 ls
instead of
awsudo -u production 'aws s3 ls'

That would make it more acceptable since we would be able to create aliases, such as:

alias awsp="awsudo -u production"

awsp AWS_KINESIS_STREAM=funky-stream ./my_project

Update

Still trying to figure a way around clap with this one: clap-rs/clap#1344

Brew formula

Create a brew formula so its easy to install on macOS :)