aws-runas 0.2.0

Listing available roles

Use the -l option to see the list of role ARNs your IAM account is authorized to assume. May be helpful for setting up your AWS config file. If profile arg is specified, list roles available for the given profile, or the default profile if not specified. May be useful if you have multiple profiles configured each with their own IAM role configurations

Listing available MFA devices

Use the -m option to list the ARNs of any MFA devices associated with your IAM account. May be helpful for setting up your AWS config file. If profile arg is specified, list MFA devices available for the given profile, or the default profile if not specified. May be useful if you have multiple profiles configured each with their own MFA device

Displaying session token expiration

Use the -e option to display the date and time which the session token will expire. If profile arg is specified, display info for the given profile, otherwise use the ‘default’ profile. Specifying the profile name may be useful if you have multiple profiles configured which you get session tokens for.

Injecting SessionToken credentials into the environment

Use the -s option to output and eval()-able set of environment variables for the session token credentials. If profile arg is specified, display the session token credentials for the given profile, otherwise use the default profile.

Example:

Or simply eval $(aws-runas -s) to add these env vars to the running environment. Since session tokens generally live for multiple hours, injecting these credentials into the environment may be useful when using tools which can do AssumeRole on their own, and manage/refresh the relativly short-lived AssumeRole credentials internally.

Injecting AssumeRole credentials into the environment

Running the program with only a profile name will output an eval()-able set of environment variables for the assumed role credentials which can be added to the current session.

Example:

Or simply eval $(aws-runas admin-profile) to add these env vars in the current session. With the addition of caching session token credentials, and the ability to automatically refresh the credentials, eval-ing this output for assumed role credentials is no longer necessary for most cases, but will be left as a feature of this tool for the foreseeable future.

Running command using a profile

Running the program specifying a profile name and command will execute the command using the profile credentials, automatically performing any configured assumeRole operation, or MFA token gathering.

Example (run the command aws s3 ls using the profile admin-profile):

Running command using the default profile

Running the program using the default profile is no different than using a custom profile, simply use default as the profile name.

Building from source

A Makefile has been included in the repository to handle the steps of creating the package and uploading it to pypi. If you don’t have the make utility installed, the contents of the Makefile should be instructive (and simple) enough to execute manually.

The following targets are available in the Makefile:

• package - the default target, calls the setup.py script to create the package to upload to pypi.

• upload - depends on the package target, and uploads the generated package archive to pypi.

• install - use pip to install the package locally

• clean - clean up the artifacts left by the package step.

• distclean - depends on the clean target, and additionally cleans up misc. files.