Skip to main content

Unified CLI tool for streamlined AWS operations

Project description

aws fusion

Unified CLI tool for streamlined AWS operations, enhancing developer productivity

Tag Publish

Installation

Install via pip install

pip install aws-fusion

Command line tool

To invoke the cli, there are 2 option

  1. Directly use aws-fusion command
  2. Use it via aws cli alias with aws fusion

Usage

usage: aws-fusion [<flags>] <command> ...

Unified CLI tool for streamlined AWS operations, enhancing developer productivity

Flags:
  -h, --help    show this help message and exit
  -v, --version Display the version of this tool
  --debug       Turn on debug logging

Command:
  init [<flags>]
    Initialize fusion app with creation of aws fusion alias.
  
  open-browser [<flags>] [<args>]
    Open a web browser for graphical access to the AWS Console.
    
    -p, --profile PROFILE The AWS profile to create the pre-signed URL with
    -r, --region REGION   The AWS Region to send the request to
        --clip            Don't open the web browser, but copy the signin URL to clipboard
        --stdout          Don't open the web browser, but echo the signin URL to stdout
  
  iam-user-credentials [<flags>] <sub-command>
    IAM User credential helper.

  iam-user-credentials get [<flags>] [<args>]
    Retrieve IAM user credentials for AWS CLI profiles or application authentication.
        
        --access-key ACCESS_KEY AWS access key
        --account-id ACCOUNT_ID AWS Account ID for the name
        --username USERNAME     Username of a AWS user associated with the access key for the name
        --credential-process    Output the credential in AWS credential process syntax

  iam-user-credentials store [<flags>] [<args>]
    Store IAM user access key and secret key securely for streamlined authentication.
    
        --access-key ACCESS_KEY AWS access key
        --account-id ACCOUNT_ID AWS Account ID for the name
        --username USERNAME     Username of a AWS user associated with the access key for the name
        --secret-key SECRET_KEY AWS secret key
        
  okta [<flags>] <sub-command>
    Generate AWS session credentials from Okta.
    
  okta device-auth [<flags>] [<args>]
    Generate AWS session credentials using SAML assertion from Okta device authentication.

        --org-domain ORG_DOMAIN                   Full domain hostname of the Okta org e.g. example.okta.com
        --oidc-client-id OIDC_CLIENT_ID           The ID is the identifier of the client is Okta app acting as the IdP for AWS
        --aws-acct-fed-app-id AWS_ACCT_FED_APP_ID The ID for the AWS Account Federation integration app
        --aws-iam-role AWS_IAM_ROLE               The AWS IAM Role ARN to assume
        --credential-process                      Output the credential in AWS credential process syntax

  config-switch [<flags>] <sub-command>
    Switching between AWS config.
    
  config-switch profile [<flags>]
    Switch between available aws profile.
  
  config-switch region [<flags>]
    Switch between available aws region.

Use case of open-browser

This only works with assume-role and federated-login, doesn't work with IAM user or user session.

IAM assume role

Profiles that use IAM roles pull credentials from another profile, and then apply IAM role permissions.

In the following examples, iam-user is the source profile for credentials and iam-assume-role borrows the same credentials then assumes a new role.

Credentials file

[profile iam-user]
aws_access_key_id=AKIAIOSFODNN7EXAMPLE
aws_secret_access_key=wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY

Config file

[profile iam-user]
region = us-east-1
output = json

[profile iam-assume-role]
source_profile = iam-user
role_arn = arn:aws:iam::777788889999:role/user-role
role_session_name = my-session
region = ap-south-1
output = json

Federated login

Using IAM Identity Center, you can log in to Active Directory, a built-in IAM Identity Center directory, or another IdP connected to IAM Identity Center. You can map these credentials to an AWS Identity and Access Management (IAM) role for you to run AWS CLI commands.

In the following examples, using aws-sso profile assumes sso-read-only-role on 111122223333 account.

Config file

[profile aws-sso]
sso_session = my-sso-session
sso_account_id = 111122223333
sso_role_name = sso-read-only-role
role_session_name = my-session
region = us-east-1
output = json

[sso-session my-sso-session]
sso_region = us-east-2
sso_start_url = https://my-sso-portal.awsapps.com/start
sso_registration_scopes = sso:account:access

Refer

The docs


Usa case of iam-user-credentials store

To store IAM user credential in the system credential store for best security rather than plain text ~/.aws/credentials file.

Manually the save the credential in the store using

aws-fusion iam-user-credentials store \
    --access-key 'AKIAIOSFODNN7EXAMPLE' \
    --secret-key 'wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY' \
    --account-id '123456789012' \
    --username 'my-iam-user'

Use case of iam-user-credentials get

Configure aws config file to use credential process

Config file

[profile iam-user]
region = us-east-1
output = json
credential_process = aws-fusion iam-user-credentials get --account-id 123456789012 --username 'my-iam-user' --access-key 'AKIAIOSFODNN7EXAMPLE' --credential-process

Refer

The docs


Use case of okta device-auth

Configure aws config file to use credential process

Config file

[profile iam-user]
region = us-east-1
output = json
credential_process = aws-fusion okta device-auth --org-domain my.okta.com --oidc-client-id 0pbs4fq1q2vbGoFkC1m7 --aws-acct-fed-app-id 0oa8z9xa8BS9b2AFb1t7 --aws-iam-role arn:aws:iam::123456789012:role/PowerUsers --credential-process

Use case of config-switch

A special of utility script to help easily switch profile and region

This works with 2 bash script, namely _awsp and _awsr

Using the command without the bash script will have no effect

Post installing the app, create 2 aliases in .bashrc or .zshrc file.

## aws fusion setup
alias awsp="source _awsp"
alias awsr="source _awsr"
config-switch-image

License

This project is licensed under the MIT License - see the LICENSE file for details.

Project details


Download files

Download the file for your platform. If you're not sure which to choose, learn more about installing packages.

Source Distribution

aws-fusion-1.6.1.tar.gz (14.4 kB view details)

Uploaded Source

Built Distribution

aws_fusion-1.6.1-py3-none-any.whl (16.6 kB view details)

Uploaded Python 3

File details

Details for the file aws-fusion-1.6.1.tar.gz.

File metadata

  • Download URL: aws-fusion-1.6.1.tar.gz
  • Upload date:
  • Size: 14.4 kB
  • Tags: Source
  • Uploaded using Trusted Publishing? Yes
  • Uploaded via: twine/4.0.2 CPython/3.11.8

File hashes

Hashes for aws-fusion-1.6.1.tar.gz
Algorithm Hash digest
SHA256 6232020071d080e2dde037c2f94b8e4df1479acaeb7e6d98c6eb16aa7cd6d1fd
MD5 c052dbe5dd133132e0ee1157f03f1873
BLAKE2b-256 540b8ad15fdb610ecd0e720ef517541a7cafd1b93098ca5eb51951436e4fea78

See more details on using hashes here.

File details

Details for the file aws_fusion-1.6.1-py3-none-any.whl.

File metadata

  • Download URL: aws_fusion-1.6.1-py3-none-any.whl
  • Upload date:
  • Size: 16.6 kB
  • Tags: Python 3
  • Uploaded using Trusted Publishing? Yes
  • Uploaded via: twine/4.0.2 CPython/3.11.8

File hashes

Hashes for aws_fusion-1.6.1-py3-none-any.whl
Algorithm Hash digest
SHA256 b2949c97677dca4bd10f2d9648fafa5a3f13e73797df29857f0a34ecfa1dfd1c
MD5 053c0a3938560b3dcf96af5e4c3f699e
BLAKE2b-256 0a5e823f24b78ef69ecd825dba4e1215df154e0500632cbe7390804b1f305345

See more details on using hashes here.

Supported by

AWS AWS Cloud computing and Security Sponsor Datadog Datadog Monitoring Fastly Fastly CDN Google Google Download Analytics Microsoft Microsoft PSF Sponsor Pingdom Pingdom Monitoring Sentry Sentry Error logging StatusPage StatusPage Status page