ngydv

ngydv 使用 mfa-token 创建 aws cli 会话密钥，并存储、导出它。

安装

使用 homebrew

使用此命令，下载 mac/linux 的二进制文件。

brew install K2Da/tap/ngydv

使用 cargo

cargo install ngydv

用法

您需要 aws cli 配置文件 ~/.aws/config 和 ~/.aws/credentials。

另外，如果您需要，在 ~/.aws/ngydv 中有一个额外的文件来存储您的 mfa 设备 arn。

# ~/.aws/ngydv
[profile_a]
  mfa_serial = arn:aws:iam::nnnnnnnnnnnn:mfa/user_name

子命令

创建会话 / 担任角色

根据配置文件类型创建会话或担任角色，并将其存储在 ~/.aws/ngydv_credentials.yaml 中。

并打印导出密钥和令牌的命令，因此使用方法如下。

# ngydv in {profile} {mfa_token}
source <(ngydv in profile_a 000000)
# or
. <(ngydv in profile_a 000000)

创建会话

创建如下配置文件的会话。

# .aws/credentials
[profile_a]
aws_access_key_id = XXXXXXXXXXXXXXXXXXXX
aws_secret_access_key = xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx

# .aws/config
[profile_a]
  output = yaml
  region = ap-northeast-1

# ~/aws/ngydv
[profile_a]
  mfa_serial = arn:aws:iam::nnnnnnnnnnnn:mfa/user_name

担任角色

按照如下配置文件担任角色。

# .aws/config
[profile_b]
  region = ap-northeast-1
  role_arn = arn:aws:iam::nnnnnnnnnnn:role/rolename
  mfa_serial = arn:aws:iam::mmmmmmmmmmmm:mfa/user-name
  source_profile = base_profile

导出

此子命令打印导出存储会话令牌的 sh 命令。

输出与 'in' 子命令相同，但无需再次输入 mfa 令牌。此子命令用于在多用户配置文件或多 AWS 账户之间切换。

source <(ngydv export profile)
# or
. <(ngydv export profile)

清除会话

清除 ~/.aws/ngydv_credentials.yaml 中存储的会话。

ngydv clear session

清除环境变量

清除与 AWS CLI 命令相关的环境变量。

. <(ngydv clear env)
# or
source <(ngydv clear env)

配置文件

列出可用的配置文件。

$ ngydv profile
 id | profile   | region         | type                       | credential
----+-----------+----------------+----------------------------+---------------------------------------
 1  | default   | ap-northeast-2 | Access key                 | -
 2  | hpm       | ap-northeast-1 | Access key with mfa device | expired at 2020-05-06 00:02:01 +09:00
 3  | hpmadm    | ap-northeast-1 | Assume role from hpm       | -

显示

显示当前默认配置文件。

$ ngydv show
1. checking AWS_ACCESS_KEY_ID and AWS_ACCESS_KEY_ID.
  environment variables are not set.
2. checking AWS_PROFILE.
  environment variable is not set.
3. checking profile named 'default'.

use profile "default" as default.

环境变量

列出与 AWS CLI 相关的环境变量。

$ ngydv env
 name                        | desc                                                                                     | default            | value
-----------------------------+------------------------------------------------------------------------------------------+--------------------+------------------------------------------
 AWS_ACCESS_KEY_ID           | AWS access key associated with an IAM user or role                                       |                    | XXXXXXXXXXXXXXXXXXXX
 AWS_CA_BUNDLE               | The path to a certificate bundle to use for HTTPS certificate validation                 |                    |
 AWS_CONFIG_FILE             | The location of the file that the AWS CLI uses to store configuration profiles           | ~/.aws/config      |
 AWS_DEFAULT_OUTPUT          | The output format to use                                                                 | json               |
 AWS_DEFAULT_REGION          | The AWS Region to send the request to                                                    |                    |
 AWS_PAGER                   | The pager program used for output                                                        |                    |
 AWS_PROFILE                 | The name of the CLI profile with the credentials and options to use                      | default            |
 AWS_ROLE_SESSION_NAME       | A name to associate with the role session                                                |                    |
 AWS_SECRET_ACCESS_KEY       | The secret key associated with the access key                                            |                    | xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
 AWS_SESSION_TOKEN           | The session token value that is required if you are using temporary security credentials |                    |
 AWS_SHARED_CREDENTIALS_FILE | The location of the file that the AWS CLI uses to store access keys                      | ~/.aws/credentials |