aws.plugin.zsh 7.1 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212
  1. function agp() {
  2. echo $AWS_PROFILE
  3. }
  4. # AWS profile selection
  5. function asp() {
  6. if [[ -z "$1" ]]; then
  7. unset AWS_DEFAULT_PROFILE AWS_PROFILE AWS_EB_PROFILE
  8. echo AWS profile cleared.
  9. return
  10. fi
  11. local -a available_profiles
  12. available_profiles=($(aws_profiles))
  13. if [[ -z "${available_profiles[(r)$1]}" ]]; then
  14. echo "${fg[red]}Profile '$1' not found in '${AWS_CONFIG_FILE:-$HOME/.aws/config}'" >&2
  15. echo "Available profiles: ${(j:, :)available_profiles:-no profiles found}${reset_color}" >&2
  16. return 1
  17. fi
  18. export AWS_DEFAULT_PROFILE=$1
  19. export AWS_PROFILE=$1
  20. export AWS_EB_PROFILE=$1
  21. if [[ "$2" == "login" ]]; then
  22. aws sso login
  23. fi
  24. }
  25. # AWS profile switch
  26. function acp() {
  27. if [[ -z "$1" ]]; then
  28. unset AWS_DEFAULT_PROFILE AWS_PROFILE AWS_EB_PROFILE
  29. unset AWS_ACCESS_KEY_ID AWS_SECRET_ACCESS_KEY AWS_SESSION_TOKEN
  30. echo AWS profile cleared.
  31. return
  32. fi
  33. local -a available_profiles
  34. available_profiles=($(aws_profiles))
  35. if [[ -z "${available_profiles[(r)$1]}" ]]; then
  36. echo "${fg[red]}Profile '$1' not found in '${AWS_CONFIG_FILE:-$HOME/.aws/config}'" >&2
  37. echo "Available profiles: ${(j:, :)available_profiles:-no profiles found}${reset_color}" >&2
  38. return 1
  39. fi
  40. local profile="$1"
  41. local mfa_token="$2"
  42. # Get fallback credentials for if the aws command fails or no command is run
  43. local aws_access_key_id="$(aws configure get aws_access_key_id --profile $profile)"
  44. local aws_secret_access_key="$(aws configure get aws_secret_access_key --profile $profile)"
  45. local aws_session_token="$(aws configure get aws_session_token --profile $profile)"
  46. # First, if the profile has MFA configured, lets get the token and session duration
  47. local mfa_serial="$(aws configure get mfa_serial --profile $profile)"
  48. local sess_duration="$(aws configure get duration_seconds --profile $profile)"
  49. if [[ -n "$mfa_serial" ]]; then
  50. local -a mfa_opt
  51. if [[ -z "$mfa_token" ]]; then
  52. echo -n "Please enter your MFA token for $mfa_serial: "
  53. read -r mfa_token
  54. fi
  55. if [[ -z "$sess_duration" ]]; then
  56. echo -n "Please enter the session duration in seconds (900-43200; default: 3600, which is the default maximum for a role): "
  57. read -r sess_duration
  58. fi
  59. mfa_opt=(--serial-number "$mfa_serial" --token-code "$mfa_token" --duration-seconds "${sess_duration:-3600}")
  60. fi
  61. # Now see whether we need to just MFA for the current role, or assume a different one
  62. local role_arn="$(aws configure get role_arn --profile $profile)"
  63. local sess_name="$(aws configure get role_session_name --profile $profile)"
  64. if [[ -n "$role_arn" ]]; then
  65. # Means we need to assume a specified role
  66. aws_command=(aws sts assume-role --role-arn "$role_arn" "${mfa_opt[@]}")
  67. # Check whether external_id is configured to use while assuming the role
  68. local external_id="$(aws configure get external_id --profile $profile)"
  69. if [[ -n "$external_id" ]]; then
  70. aws_command+=(--external-id "$external_id")
  71. fi
  72. # Get source profile to use to assume role
  73. local source_profile="$(aws configure get source_profile --profile $profile)"
  74. if [[ -z "$sess_name" ]]; then
  75. sess_name="${source_profile:-profile}"
  76. fi
  77. aws_command+=(--profile="${source_profile:-profile}" --role-session-name "${sess_name}")
  78. echo "Assuming role $role_arn using profile ${source_profile:-profile}"
  79. else
  80. # Means we only need to do MFA
  81. aws_command=(aws sts get-session-token --profile="$profile" "${mfa_opt[@]}")
  82. echo "Obtaining session token for profile $profile"
  83. fi
  84. # Format output of aws command for easier processing
  85. aws_command+=(--query '[Credentials.AccessKeyId,Credentials.SecretAccessKey,Credentials.SessionToken]' --output text)
  86. # Run the aws command to obtain credentials
  87. local -a credentials
  88. credentials=(${(ps:\t:)"$(${aws_command[@]})"})
  89. if [[ -n "$credentials" ]]; then
  90. aws_access_key_id="${credentials[1]}"
  91. aws_secret_access_key="${credentials[2]}"
  92. aws_session_token="${credentials[3]}"
  93. fi
  94. # Switch to AWS profile
  95. if [[ -n "${aws_access_key_id}" && -n "$aws_secret_access_key" ]]; then
  96. export AWS_DEFAULT_PROFILE="$profile"
  97. export AWS_PROFILE="$profile"
  98. export AWS_EB_PROFILE="$profile"
  99. export AWS_ACCESS_KEY_ID="$aws_access_key_id"
  100. export AWS_SECRET_ACCESS_KEY="$aws_secret_access_key"
  101. if [[ -n "$aws_session_token" ]]; then
  102. export AWS_SESSION_TOKEN="$aws_session_token"
  103. else
  104. unset AWS_SESSION_TOKEN
  105. fi
  106. echo "Switched to AWS Profile: $profile"
  107. fi
  108. }
  109. function aws_change_access_key() {
  110. if [[ -z "$1" ]]; then
  111. echo "usage: $0 <profile>"
  112. return 1
  113. fi
  114. echo "Insert the credentials when asked."
  115. asp "$1" || return 1
  116. AWS_PAGER="" aws iam create-access-key
  117. AWS_PAGER="" aws configure --profile "$1"
  118. echo "You can now safely delete the old access key running \`aws iam delete-access-key --access-key-id ID\`"
  119. echo "Your current keys are:"
  120. AWS_PAGER="" aws iam list-access-keys
  121. }
  122. function aws_profiles() {
  123. [[ -r "${AWS_CONFIG_FILE:-$HOME/.aws/config}" ]] || return 1
  124. grep --color=never -Eo '\[.*\]' "${AWS_CONFIG_FILE:-$HOME/.aws/config}" | sed -E 's/^[[:space:]]*\[(profile)?[[:space:]]*([-_[:alnum:]\.@]+)\][[:space:]]*$/\2/g'
  125. }
  126. function _aws_profiles() {
  127. reply=($(aws_profiles))
  128. }
  129. compctl -K _aws_profiles asp acp aws_change_access_key
  130. # AWS prompt
  131. function aws_prompt_info() {
  132. [[ -n "$AWS_PROFILE" ]] || return
  133. echo "${ZSH_THEME_AWS_PREFIX:=<aws:}${AWS_PROFILE:gs/%/%%}${ZSH_THEME_AWS_SUFFIX:=>}"
  134. }
  135. if [[ "$SHOW_AWS_PROMPT" != false && "$RPROMPT" != *'$(aws_prompt_info)'* ]]; then
  136. RPROMPT='$(aws_prompt_info)'"$RPROMPT"
  137. fi
  138. # Load awscli completions
  139. # AWS CLI v2 comes with its own autocompletion. Check if that is there, otherwise fall back
  140. if command -v aws_completer &> /dev/null; then
  141. autoload -Uz bashcompinit && bashcompinit
  142. complete -C aws_completer aws
  143. else
  144. function _awscli-homebrew-installed() {
  145. # check if Homebrew is installed
  146. (( $+commands[brew] )) || return 1
  147. # speculatively check default brew prefix
  148. if [ -h /usr/local/opt/awscli ]; then
  149. _brew_prefix=/usr/local/opt/awscli
  150. else
  151. # ok, it is not in the default prefix
  152. # this call to brew is expensive (about 400 ms), so at least let's make it only once
  153. _brew_prefix=$(brew --prefix awscli)
  154. fi
  155. }
  156. # get aws_zsh_completer.sh location from $PATH
  157. _aws_zsh_completer_path="$commands[aws_zsh_completer.sh]"
  158. # otherwise check common locations
  159. if [[ -z $_aws_zsh_completer_path ]]; then
  160. # Homebrew
  161. if _awscli-homebrew-installed; then
  162. _aws_zsh_completer_path=$_brew_prefix/libexec/bin/aws_zsh_completer.sh
  163. # Ubuntu
  164. elif [[ -e /usr/share/zsh/vendor-completions/_awscli ]]; then
  165. _aws_zsh_completer_path=/usr/share/zsh/vendor-completions/_awscli
  166. # NixOS
  167. elif [[ -e "${commands[aws]:P:h:h}/share/zsh/site-functions/aws_zsh_completer.sh" ]]; then
  168. _aws_zsh_completer_path="${commands[aws]:P:h:h}/share/zsh/site-functions/aws_zsh_completer.sh"
  169. # RPM
  170. else
  171. _aws_zsh_completer_path=/usr/share/zsh/site-functions/aws_zsh_completer.sh
  172. fi
  173. fi
  174. [[ -r $_aws_zsh_completer_path ]] && source $_aws_zsh_completer_path
  175. unset _aws_zsh_completer_path _brew_prefix
  176. fi