rolesanywhere-onboard 1.0.0

Plug-and-play client for onboarding users against a self-hosted IAM Roles Anywhere Central CA

rolesanywhere-onboard

Plug-and-play client for onboarding users against a self-hosted IAM Roles Anywhere Central CA.

Cross-platform (Linux, macOS, Windows) — the only non-stdlib dependency is cryptography for local RSA keypair generation (Python has no built-in asymmetric crypto, and this avoids depending on a system openssl binary, which Windows doesn't ship by default).

Install

pip install rolesanywhere-onboard

CLI

rolesanywhere-onboard --url <ApiEndpoint> --secret <ApiKeyValue> --name alice \
    --trust-anchor-arn <arn> --profile-arn <arn> --role-arn <arn> --days 365

Admin mode (uses your own AWS credentials instead of a shared API key):

rolesanywhere-onboard --lambda <IssuerFunctionName> --name alice \
    --trust-anchor-arn <arn> --profile-arn <arn> --role-arn <arn>

As a library

from rolesanywhere_onboard import request_certificate, get_credentials

result = request_certificate(url="...", secret="...", name="alice", days=365)
creds = get_credentials(result.cert_path, result.key_path,
                         trust_anchor_arn, profile_arn, role_arn)
# {"AccessKeyId": ..., "SecretAccessKey": ..., "SessionToken": ..., "Expiration": ...}

Requirements

• Python 3.13+
• The aws CLI, but only if using --lambda (admin) mode — the public --url/--secret mode needs no AWS credentials or tooling at all.

License

MIT