Package: aws-shelltools
Yet another set of scripts and shell functions for managing AWS profiles
and cross account access.InstallInstall into python virual environment:source ~/path-to-venv/bin/activate
pip install aws-shelltoolsInstall from editable local repository:git clone https://github.com/ucopacme/aws-shelltools
cd aws-shelltools
pip install -r requirements.txt
pip install -e .Uninstall:pip uninstall aws-shelltoolsConfigure:aws-shelltools-setup
. ~/.bashrcThe shelltools:aws-profileSet or display value of shell environment var AWS_PROFILEaws-regionSet or display value of shell environment var AWS_DEFAULT_PROFILEaws-envPrint current values of all AWS environment varsaws-set-mfa-tokenRequest temporary session credentials from AWS STS.  Export these credentials
to environment vars in the current shell.aws-make-configGenerate aws client config file by listing group assume role policies.  You
must set your MFA token before you run this command.aws-list-rolesPrint list of available AWS assume role profiles.aws-assume-roleRun ‘aws sts assume-role’ operation to obtain temporary assumed role
credentials for the specified profile.  Export these credentials to
environment vars in the current shell.aws-refreshReset mfa token. If environment var AWS_ASSUMED_ROLE_PROFILE is already
set from a previous session, then rerun ‘aws sts assume-role’ operation
for that profile.aws-display-assumed-rolePrint current values of AWS assumed role environment varsaws-whoamiPrint output of ‘aws sts get-caller-identityaws-export-envCache AWS environment vars to local file for use by other shellsaws-import-envEvaluate cached AWS evironment vars into current shellaws-drop-assumed-roleReset AWS session environment vars to values prior to assuming roleaws-unset-mfa-tokenUnset all AWS session token environemt varsUsage:# Run each command with -h option for full usage info.

aws-profile [<profile>]
aws-region [<region>]
aws-set-mfa-token
aws-make-config
aws-list-roles
aws-assume-role <profile>
aws-refresh

aws-display-assumed-role
aws-whoami
aws-env
aws-export-env
aws-import-env

aws-drop-assumed-role
aws-unset-mfa-tokenConfigure Assume Role ProfilesIf you have not yet set up your AWS CLI access, skip to sectionAwscli/Python Setupbefore proceeding.Set your MFA token and assume role to one of your configured assume role profiles:(python3.6) ashleygould$ aws-set-mfa-token
please enter 6 digit token code for your MFA device: 351918
(python3.6) ashleygould$ aws-assume-role ashley-training-OrgAdmin
(python3.6) ashleygould$ aws-whoami
{
    "UserId": "AROAIMADVT2W7CODNCP7W:agould@ashley-training-OrgAdmin",
    "Account": "111111111111",
    "Arn": "arn:aws:sts::111111111111:assumed-role/OrgAdmin/agould@ashley-training-OrgAdmin"
}Now you can runaws-make-configto generate your assume role profiles based
on your group membership in a centralauthaccount.  These are written to~/.aws/config.d/config.aws_shelltools:(python3.6) ashleygould$ aws-make-config
(python3.6) ashleygould$ head ~/.aws/config.d/config.aws_shelltools
[profile ashley-training-OrgAdmin]
role_arn = arn:aws:iam::111111111111:role/awsauth/OrgAdmin
role_session_name = agould@ashley-training-OrgAdmin
source_profile = default

[profile Auth-OrgAdmin]
role_arn = arn:aws:iam::222222222222:role/awsauth/OrgAdmin
role_session_name = agould@Auth-OrgAdmin
source_profile = defaultSee a listing or all your available AWS profiles:(python3.6) ashleygould$ aws-list-roles
profile Auth-OrgAdmin
profile OrgMaster-OrgAdmin
profile ashley-training-OrgAdmin
profile eas-dev-OrgAdmin
profile eas-prod-OrgAdminYou can shorten the profile name at the command line to a unique prefix:(python3.6) ashleygould$ aws-assume-role eas
Your specified profile 'eas' matches multiple configured profiles. Select one from
the list below and try again:
  eas-dev-OrgAdmin eas-prod-OrgAdmin
  ucop-itssandbox-eas-OrgAdmin
(python3.6) ashleygould$ aws-assume-role eas-dev
(python3.6) ashleygould$ aws-whoami
{
    "UserId": "AROAJFPJVRDRDFUZJLZVG:agould@eas-dev-OrgAdmin",
    "Account": "111111111111",
    "Arn": "arn:aws:sts::111111111111:assumed-role/OrgAdmin/agould@eas-dev-OrgAdmin"
}Awscli/Python SetupThe above install insturctions assume you have a working knowledge of python
and awscli.  If you are new at this, refer to the excellent AWS documentation:https://docs.aws.amazon.com/cli/latest/userguide/installing.htmlThis covers installation of python and python virtual environments for Linux,
MacOS, and Windows.  Once your python is happy, running the installation ofaws-shelltoolswill ensureawscli`and `boto3are also properly installed.AWS Access Key SetupBefore you can use any of this stuff, you must create your AWS access key and
secret access key and confiture your AWS shell profile.  see:https://docs.aws.amazon.com/cli/latest/userguide/cli-chap-getting-started.htmlLog into AWS console and create an AWS Access key as per AWS doc.  From your
shell run theaws configurecommand and cut-n-paste your access key/secret
key from the console to the command line as prompted.  This creates yourdefaultprofile:(python3.6) ashleygould$ aws configure
AWS Access Key ID [None]: AKI**********W5AFPSNQ
AWS Secret Access Key [None]: U/QotA**********************543vuYB
Default region name [None]: us-west-2
Default output format [None]:

(python3.6) ashleygould$ cat .aws/config
[default]
region = us-west-2

(python3.6) its-agould-9m:~ ashleygould$ aws-whoami
{
    "UserId": "AIDAJ2SLREGRDKVFOB6CI",
    "Account": "112233445566",
    "Arn": "arn:aws:iam::112233445566:user/awsauth/orgadmin/agould"
}Working With Codecommit RepositoriesTo access codecommit repositories from the commandline after assuming a role,
you must first configure git to use the AWS codecommit credential-helper:git config --global credential.helper '!aws codecommit credential-helper $@'
git config --global credential.UseHttpPath true