Package: aws-profile-gpg
aws-profile-gpgA script for calling theaws-cliusingIAM Access Keysfrom aGPGencrypted credentials file.The script is inspired by the variousaws-profilewrappers found on GitHub, plus a desire to keep credentials encrypted at rest.Benefits1. Your secret access keys are encrypted at rest on disk so if someone gains access to your machine, they still won't have access to your AWS credentials2. You can safely store your encrypted credentials in Dropbox or on a server so you can access the same config and credentials files from multiple machines3. Since the script works by decrypting the credentials file and addingAWS_ACCESS_KEY_IDandAWS_SECRET_ACCESS_KEYto the processes environment, you can use it with other apps the use these environment variables, e.g.Terraform4. If you use anOpenGPG cardsuch as aYubikeyas a private key, it will effectively act as a hardware MFA device for your access keysDetails and use cases are outlined inUsagebelow.PrerequisitesThis guide assumes you are familiar GPG and are able to encrypt your credentials file.  If you are not familiar with GPG, there are a number ofgood tutorials online.InstallUsing Homebrewbrew bundleorbrew tap jefforulez/jefforulez
brew install aws-profile-gpgUsing PyPIpip install aws-profile-gpgUsageBasic usageusage: aws-profile-gpg [-h] [-v] command [command ...]

positional arguments:
  command        command passed to aws cli

optional arguments:
  -h, --help     show this help message and exit
  -v, --verbose  verbose outputUsing the default configurationaws-profile-gpg aws s3 lsSpecifying an aws profileAWS_PROFILE=iam_leet \
  aws-profile-gpg aws s3 lsSpecifying an alternative credentials fileAWS_ENCRYPTED_CREDENTIALS_FILE=/path/to/shared/aws/credentials.asc \
  aws-profile-gpg aws s3 lsSpecifying an alternative config fileAWS_CONFIG_FILE=/path/to/shared/aws/config \
  aws-profile-gpg aws s3 lsStoring config and credentials files in DropboxAWS_CONFIG_FILE=${HOME}/Dropbox/etc/aws/config \
  AWS_ENCRYPTED_CREDENTIALS_FILE=${HOME}/Dropbox/aws/credentials.gpg \
  aws-profile-gpg aws s3 lsUsing with terraformAWS_PROFILE=terraform \
  aws-profile-gpg terraform -planEnvironmental VariablesAWS_PROFILE_GPG_HOMEPath toaws-profile-gpgdirectory; Used to locate virtualenv and python scriptDefaults to/usr/local/opt/aws-profile-gpgAWS_ENCRYPTED_CREDENTIALS_FILEPath to GPG encrypted credentials fileSupports both plain.gpgand ascii-armored.ascfilesDefaults to~/.aws/credentials.gpgAWS_CONFIG_FILESeeAWS Command Line InterfaceDefaults to~/.aws/configNote:If you change this, you must define all profiles in the custom config fileAWS_DEFAULT_PROFILESeeAWS Command Line InterfaceDefaults todefaultNotesCreating Bash ShortcutsCreating bash functions is helpful for quickly invoking different profiles:$ vim ~/.bash_profile

# optional
export AWS_ENCRYPTED_CREDENTIALS_FILE="${HOME}/Dropbox/aws/credentials.gpg"
export AWS_CONFIG_FILE="${HOME}/Dropbox/aws/config"

function aws-leet {
  AWS_PROFILE=iam_leet \
  aws-profile-gpg \
  aws \
  $@
}

function aws-terraform {
  AWS_PROFILE=terraform \
  aws-profile-gpg \
  aws \
  $@
}You can then run:$ source ~/.bash_profile$ aws-leet iam get-user
{
  "User": {
    "Path": "/",
    "UserName": "iam.leet",
    "UserId": "AID35DF67GHFEK3",
    "Arn": "arn:aws:iam::737415635305:user/iam.leet",
    "CreateDate": "1970-01-01T00:00:00Z",
    "PasswordLastUsed": "2000-01-01T00:00:01Z"
  }
}Specifying Profiles in Config FilesTheAWS_PROFILEyou use must be defined in yourAWS_CONFIG_FILEfile, e.g.$ cat ~/.aws/config

[profile default]
region=us-east-1

[profile iam_leet]
region=us-east-1This applies to thedefaultprofile too.If you try to use an undefined profile, you will see this error:Profile not found in config; profile=iam_leetRelated LinksVarious version ofaws-profileon GitHubhttps://github.com/search?q=aws-profileGNU Privacy Guard (GPG)https://www.gnupg.orgPyGPGMEhttps://launchpad.net/pygpgmehttps://pygpgme.readthedocs.io/en/latest/Botocorehttps://github.com/boto/botocore