Package: awshelper
AWS Helperhttps://pypi.org/project/awshelper/A utility that lets you use AWS SSO credentials when running tools that talk to AWS.RationaleAWS CLI v2 and AWS SSO use a completely new and different way to persist aws credentials.
This is likely to break compatability with a lot of existing tools that use AWS apis such as
terraform, awslogs and probably thousands more.AWS Helper reads the "new and modern" credentials stored by aws cli v2,
and extracts "old-school" environment variables from them. It then executes the specified command, within this environment.Prereqs:awshelper requires python 3.x (tested on 3.8) and pipaws cli v2 installed (make sure you run a recent build)your org is set up with AWS SSO so that you can runaws configure sso --profile myprofile(a named profile is needed)
If all this works, you're good to go.How to use awshelperinstall it:pip install awshelperorpip3 install awshelperdepending on your setup.
You should use a root/sudo user to install it globallyyou can either use env vars to specify your profile:AWS_PROFILE=mytest awshelper <command>orawshelper --profile mytest <command>orawshelper --profile=mytest <command>.In any case, a named profile IS required (at least for now)In some cases, you may have an SSO session, but not a valid aws cli credentials cache file,
since these are generated when you run the first aws cli command after refreshing sso credentials.
awshelper tries to be smart about this, and run aws cli commands if needed, to refresh the cache.
It attemps to print clearly what is happening and, in case of errors, what you need to do.If you're a fan ofawslogsyou can now run it usingawshelper:AWS_PROFILE=mytest awshelper awslogs groups --aws-region eu-central-1...oreksctl:AWS_PROFILE=mytest awshelper eksctl create cluster -f eksfargate.ymlOther environment variablesIf you run scripts that need to determine whether or not they're executed with awshelper, you can use the following environment variables to determine that:AWSHELPER_ENABLEDwill have a value ofYES.AWSHELPER_PROFILEwill be set to whatever profile got configured usingAWS_PROFILEor the--profileparameter as described above.Integration with External Process-based credentialsSome AWS tools such as the aws cli, supports "Sourcing Credentials with an External Process",
described here:https://docs.aws.amazon.com/cli/latest/userguide/cli-configure-sourcing-external.html.
awshelper can function as the external process. In this mode, instead of injecting environment variables to a wrapped process,
it will instead output the necessary json structure to std when called. To use this mode, run awshelper like this:AWS_PROFILE=mytest EXTERNAL_PROCESS_MODE=true awshelperThe recommended way to use this, is to add the following to your/.aws/configfile:[profile myprofile]
region = eu-central-1
credential_process = /home/trond/bin/awshelper_prochelper.shand then that bash file could look something like this:╰─catawshelper_prochelper.sh#!/usr/bin/env bashEXTERNAL_PROCESS_MODE=trueAWS_PROFILE=someprofileawshelperI'm not quite sure how aws cli deals with the potential "circular dependency" of
callingaws configure ssowith a profile where acredential_processstatement is added,
so use this at your own peril! You might also have problems using this with various tools -
I tested quickly with theserverlesstools which are javascript-based and it seems to NOT work there.
Your mileage may varyIntegration .env filesIt can be hard to use a wrapper process such asawshelperwhen debugging things from an IDE etc.
In order to support this type of workflow, awshelper can inject credentials into a.envfile, which most modern IDE's can read and use as source of environment variables when it starts your project.
In order to do this, simply run awshelper like this:AWS_PROFILE=mytest DOTENV_FILE_MODE=true awshelper. You need to run awshelper in the directory where the .env file exists (or should be created). Any existing values in the .env file will be retained, only the necessary AWS credentials values will be updated.You can wrap this functionality in a bash script and use it with IntelliJ's "run external tool" or similar, to ensure your.envfile always contains a valid set of credentials.Limitationsan AWS profile name IS needed - either specified using environment variables or parameters. If both are specified, the parameter "wins".it will only work with profiles configured withaws configure sso. If you point to a profile with regular access key/secret, it won't work.Test using docker:docker run -it -v ~/.aws:/root/.aws:ro ubuntuthen runapt-get update && apt-get install python3-pip
pip3 install awshelper 
AWS_PROFILE=mytest awshelper <my command>