Get AWS credentials from a profile to inject into other programs
Project description
aws-export-credentials
Get AWS credentials from a profile to inject into other programs
There are a number of other projects that extract AWS credentials and/or inject them into programs, but all the ones I've seen use the CLI's cache files directly, rather than leveraging botocore's ability to retrieve and refresh credentials. So I wrote this to do that.
botocore (the underlying Python SDK library) has added support for loading credentials cached by aws sso login
as of version 1.17.0.
aws-export-credentials
now requires botocore >= 1.17.0, and so supports AWS SSO credentials as well.
If all you want is AWS SSO support for an SDK other than Python, take a look at aws-sso-credential-process, which doesn't require the credential injection process that aws-export-credentials
does.
Quickstart
I recommend you install pipx
, which installs the tool in an isolated virtualenv while linking the script you need.
# with pipx
pipx install aws-export-credentials
# without pipx
python3 -m pip install --user aws-export-credentials
# run it
aws-export-credentials
{
"Version": 1,
"AccessKeyId": "<your access key here>",
"SecretAccessKey": "<shhh it's your secret key>",
"SessionToken": "<do you ever wonder what's inside the session token?>"
}
Usage
Profile
Profiles work like in the AWS CLI (since it uses botocore); it will pick up the AWS_PROFILE
or AWS_DEFAULT_PROFILE
env vars, but the --profile
argument takes precedence.
JSON
aws-export-credentials --profile my-profile --json [--pretty]
Print the credentials to stdout as a JSON object compatible with the credential_process
spec. If --pretty
is added, it'll be pretty-printed.
Env vars
aws-export-credentials --profile my-profile --env
export $(aws-export-credentials --profile my-profile --env)
eval $(aws-export-credentials --profile my-profile --env-export)
Print the credentials as environment variables. With --env-export
, the lines are prefixed
by "export
".
Exec wrapper
aws-export-credentials --profile my-profile --exec echo 'my access key id is $AWS_ACCESS_KEY_ID'
Execute the arguments after --exec
using os.system()
, injecting the credentials through
environment variables.
~/.aws/credentials
aws-export-credentials --profile my-profile --credentials-file-profile my-exported-profile
aws-export-credentials --profile my-profile -c my-exported-profile
Put the credentials in the given profile in your shared credentials file, which is typically ~/.aws/credentials
but can be controlled using the environment variable AWS_SHARED_CREDENTIALS_FILE
.
Caching
To avoid retrieving credentials every time when using aws-export-credentials
with the same identity, you can cache the credentials in a file using the --cache-file
argument.
Note aws-export-credentials
does not distinguish between different identities in the cache. Different identities should use different cache files.
Cache loading and saving fails silently, to ensure caching does not interrupt usage.
If caching is not working, you can see the details with --debug
.
By default, cached credentials are considered expired if their expiration is less than 10 minutes in the future.
You can change this value using the --cache-expiration-buffer
argument, which takes a number of minutes.
You can force the cache to refresh using --refresh
.
Project details
Release history Release notifications | RSS feed
Download files
Download the file for your platform. If you're not sure which to choose, learn more about installing packages.
Source Distribution
Built Distribution
Hashes for aws-export-credentials-0.6.0.tar.gz
Algorithm | Hash digest | |
---|---|---|
SHA256 | b205d6407a9f706ae87a6a2772c4358c9ecc4dda5cfa410faaedb5765f30b7e3 |
|
MD5 | bc3f3520dadf1cc84fa55e90117b2a16 |
|
BLAKE2b-256 | 70726b9bf040adc494fa43c8d62192729c81fc2b92f54f79e43b02829862bf50 |
Hashes for aws_export_credentials-0.6.0-py3-none-any.whl
Algorithm | Hash digest | |
---|---|---|
SHA256 | 935f6d1c00382a298d3710c86d64250f186e697ba31ba1120a3a773af5261aea |
|
MD5 | a8b92a1dc48bdd63000ab721c9580b04 |
|
BLAKE2b-256 | f1a9b90b9e7131e264aca74fce073fc73c2c563c81f0017c6dff4e40286d5f98 |