Skip to main content

Generates AWS credentials for roles using STS

Project description

https://img.shields.io/pypi/v/aws_role_credentials.svg https://snap-ci.com/ThoughtWorksInc/aws_role_credentials/branch/master/build_image

Generates AWS credentials for roles using STS and writes them to `~/.aws/credentials`

Usage

Simply pipe a SAML assertion into awssaml

# create credentials from saml assertion
$ oktaauth -u jobloggs | aws_role_credentials saml --profile dev

Or for assuming a known role name:

# create credentials from saml assertion using a known role ARN
$ oktaauth -u jobloggs | aws_role_credentials saml --profile dev --role-arn arn:aws:iam::098765432109:role/ReadOnly

Or for assuming a role using an IAM user:

# create credentials from an iam user
$ aws_role_credentials user \
  arn:aws:iam::111111:role/dev jobloggs-session \
  --profile dev

For roles that require MFA:

# create credentials from an iam user with mfa
$ aws_role_credentials user \
  arn:aws:iam::111111:role/dev jobloggs-session \
  --profile dev \
  --mfa-serial-number arn:aws:iam::111111:mfa/Jo \
  --mfa-token 102345

Transient mode

`aws_role_credentials` also supports ‘transient’ mode where the credentials are passed to a command as environment variables within the process. This adds an extra layer of safety and convinience.

To use transient mode simply pass a command to the `--exec` option like so:

# run 'aws s3 ls' with the generated role credentials from an iam user
$ aws_role_credentials user \
  arn:aws:iam::111111:role/dev jobloggs-session \
  --exec 'aws s3 ls'

Options

--profile Use a specific profile in your credential file (e.g. Development). Defaults to sts.
--region The region to use. Overrides config/env settings. Defaults to us-east-1.
--role-arn Optional role ARN to use when multiple roles are available.
--exec The command to execute with the AWS credentials

Authors

  • Peter Gillard-Moss

History

0.1.0 (2015-01-11)

  • First release on PyPI.

Project details


Download files

Download the file for your platform. If you're not sure which to choose, learn more about installing packages.

Files for aws-role-credentials, version 0.6.4
Filename, size File type Python version Upload date Hashes
Filename, size aws_role_credentials-0.6.4-py2.py3-none-any.whl (9.8 kB) File type Wheel Python version py2.py3 Upload date Hashes View
Filename, size aws_role_credentials-0.6.4.tar.gz (18.1 kB) File type Source Python version None Upload date Hashes View

Supported by

AWS AWS Cloud computing Datadog Datadog Monitoring DigiCert DigiCert EV certificate Facebook / Instagram Facebook / Instagram PSF Sponsor Fastly Fastly CDN Google Google Object Storage and Download Analytics Microsoft Microsoft PSF Sponsor Pingdom Pingdom Monitoring Salesforce Salesforce PSF Sponsor Sentry Sentry Error logging StatusPage StatusPage Status page