Package: afp-cli
OverviewThe AFP CLI is the command line interface to access the
AWS Federation Proxy (AFP).Its main use case is starting a new shell where your temporary
AWS credentials have been exported into the environment.InstallationThe tool ishosted on PyPiand can be
installed using the usual Python specific mechanisms, e.g.:$pipinstallafp-cliConfigurationTheafpcommand can be configured through yaml files in
the following directories:/etc/afp-cli/*.yaml(global configuration)$HOME/.afp-cli/*.yaml(per-user configuration)The yaml files are read in lexical order and merged viayamlreader.
The following configuration options are supported:api_url:<api-url>Defaults to lookup a FQDN of a host namedafpvia DNS and construct
the server url from it:https://{FQDN}/afp-api/latestThe specified url must contain full server url (not just the FQDN).
This option always takes precedence overserverserver: <server>The AFP server to use. No default value.
If not overridden byapi_url(see above),api_urlwill
becomehttp://<server>//afp-api/latestuser: <username>Defaults to the currently logged in user-namepassword-provider:<provider>Viable options are:prompt(default) to prompt for the password during
every interaction with the AFP server orkeyringto use the Pythonkeyringmodule. For more info about using thekeyringmodule, see
below.Example:user:myuserapi_url:https://afp-server.my.domain/afp-api/latestpassword-provider:keyringUsageGet Help Text$afp[-h|--help]List Available Account Names and RolesFor the currently logged-in user:$afpThe same for another user:$afp--user=usernameOutput format:<accountname>    <role1>,<role2>,...,<roleN>Example output:abc_account    some_role_in_abc_account
xyz_account    some_role_in_yxz_account,another_role_in_xyzObtain AWS CredentialsThis starts a subshell in which the credentials have been exported into the
environment. Use theexitcommand or pressCTRL+Dto terminate the
subshell.Use credentials for currently logged in user and specified account and role:$afpaccountnamerolenameUse credentials for the currently logged in user for thefirstrole:$afpaccountnameAs above, but specifying a different user:$afp--user=usernameaccountnamerolenameSpecify the URL of the AFP server, overriding any config file:$afp--api-url=https://afp-server.my.domain/afp-api/latestShow and ExportIn case you don’t want to start a subshell or are using something other than
bash, you can use--showor--exportto display the credentials. You
can use the usual UNIX tools to add/remove them from your environment.--showwill just show them and--exportwill show them in a format
suitable for an export into your environment, i.e. prefixed withexportfor
UNIX andsetfor Windows.$afp--show<myaccount>[<myrole>]Password for myuser:
AWS_VALID_SECONDS='600'
AWS_SESSION_TOKEN='XXX'
AWS_SECURITY_TOKEN='XXX'
AWS_SECRET_ACCESS_KEY='XXX'
AWS_EXPIRATION_DATE='1970-01-01T01:00:00Z'
AWS_ACCESS_KEY_ID='XXX'$afp--export<myaccount>[<myrole>]Password for myuser:
export AWS_VALID_SECONDS='600'
export AWS_SESSION_TOKEN='XXX'
export AWS_SECURITY_TOKEN='XXX'
export AWS_SECRET_ACCESS_KEY='XXX'
export AWS_EXPIRATION_DATE='1970-01-01T01:00:00Z'
export AWS_ACCESS_KEY_ID='XXX'The following examples work in zsh, to add and remove them from your
environment:Adding credentials:$eval$(afp--export<accountname>)Removing them again:$env|grepAWS|cut-f1-d'='|whilereadline;do;unset$line;done;Write to AWS Credentials FileThe AWS tools read credentials specified withaws configurefrom a local
file namedcredentialsin a folder named.awsin your home directory.
The afp-cli tool can write your temporary credentials to this file.$afp--write<myaccount>[<myrole>]Configuration Settings and PrecedencePlease read the section onConfiguration Settings and Precedencefrom the AWS documentation.Interface with the System KeyringStarting with version1.3.0, experimental support for thePython keyring
modulehas been implemented. This has
been tested with the Gnome Keyring and Max OS X Keychain but supposedly also
works with Windows Credential Vault. You can configure this feature using the
config file as shown above or with a command-line switch.Example command-line:$afp--password-providerkeyringNo password found in keychain, please enter it now to store it.
Password for user:You will be prompted for your password the first time. Note
that if you fail to enter the password correctly, the incorrect version will be
stored. Note further that if you are using the Gnome-Keychain you can use the
toolseahorseto update and delete saved passwords, in this case for the
serviceafp.Keyring on MacOS XOn some MacOS systems, storing the password works fine, but fetching it fails withCan’t fetch password from system. This is due to achange in the ‘keyring’ module, introduced in version 9.0. As a workaround, downgrade to the previous version withpip installkeyring==8.7Keyring with Gnome-KeychainThere is an intricate caveat when using thekeyringmodule with
Gnome-Keychain. But before discussing this, it is important to mention that
the keyring module uses another module, namelysecretstorageunder the
hood.In order for thekeyringmodule to correctly use the Gnome Keychain the
Python modulePyGObject aka giis required. As stated on the project website: “PyGObject is a Python extension
module that gives clean and consistent access to the entire GNOME software
platform through the use of GObject Introspection.” Now, unfortunately, even
though this project isavailable on PyPiit can not be installed from there
usingpipdue to issues with the build system. It is however available as a
system package for Ubuntu distributions aspython-gi.Long story short, in order to use thekeyringmodule fromafp-cliyou need to have
thegimodule available to your Python interpreter. You can achieve this,
for example, by doing a global install ofafp-cliusing something likesudo pip installafp-clior install it into a virtual environment that uses
the system site packages because it has been created with the--system-site-packagesflag. In case thegimodule is not available and
you try to use thekeyringmodule anyway,afp-cliwill exit with an
appropriate error message.  Lastly, if in doubt, you can use the--debugswitch to check at runtime which backend was selected.LicenseCopyright 2015,2016 Immobilien Scout GmbHLicensed under the Apache License, Version 2.0 (the “License”); you may not use
this file except in compliance with the License. You may obtain a copy of the
License athttp://www.apache.org/licenses/LICENSE-2.0Unless required by applicable law or agreed to in writing, software distributed
under the License is distributed on an “AS IS” BASIS, WITHOUT WARRANTIES OR
CONDITIONS OF ANY KIND, either express or implied. See the License for the
specific language governing permissions and limitations under the License.See AlsoSeeHologramfor another solution that brings temporary AWS credentials onto
developer desktops.