Package: aws2-wrap
aws2-wrapThis is a simple script to make it easier to use AWS Single Sign On credentials with tools that don't understand thessoentries in an AWS profile.The script provides the following capabilities:Run a command using AWS SSO credentialsGenerate a temporary profile in the $AWS_CONFIG_FILE and $AWS_SHARED_CREDENTIALS_FILE fileExporting the AWS SSO credentialsUse the credentials via .aws/configAssume a role via AWS SSOSupports automatic authentication refresh via AWS IAM Identity Center (https://docs.aws.amazon.com/cli/latest/userguide/sso-configure-profile-token.html)Please note that the script is calledaws2-wrapto show that it works with AWS CLI v2, even though the CLI tool is no longer calledaws2.InstallUsingpiphttps://pypi.org/project/aws2-wrappip3 install aws2-wrapUsingbrewbrew install aws2-wrapRun a command using AWS SSO credentialsaws2-wrap [--profile <awsprofilename>] [--exec] <command>Note that if you are using--execand<command>contains spaces, it must be surrounded with double-quotation marks.You can also specify the profile to be used via AWS_PROFILE which then allows the same profile to be used by subsequent tools and commands.Examples:aws2-wrap --profile MySSOProfile terraform planaws2-wrap --profile MySSOProfile --exec "terraform plan"AWS_PROFILE=MySSOProfile aws2-wrap terraform planIf you are having problems with the use of quotes in the command, you may find one of the other methods works better for you.Generate a temporary profile in the $AWS_CONFIG_FILE and $AWS_SHARED_CREDENTIALS_FILE fileThere are some utilities which work better with the configuration files rather than the environment variables. For example, if you need to access more than one profile at a time.aws2-wrap --generate --profile $AWS_PROFILE --credentialsfile $AWS_SHARED_CREDENTIALS_FILE --configfile $AWS_CONFIG_FILE --outprofile $DESTINATION_PROFILEOptionally, you can specify--generatestdoutinstead of--generate.--outprofileis still required in order to name the section but--credentialsfileand--configfileare ignored. With this command option, the generated credentials will then be output to the console.Export the AWS SSO credentialsThere may be circumstances when it is easier/better to set the appropriate environment variables so that they can be re-used by anyawscommand.Since the script cannot directly set the environment variables in the calling shell process, it is necessary to use the following syntax:eval "$(aws2-wrap [--profile <awsprofilename>] --export)"For example:eval "$(aws2-wrap --profile MySSOProfile --export)"If you are using PowerShell, the equivalent command is:aws2-wrap --profile MySSOProfile --export | invoke-expressionUse the credentials via .aws/configIf you are using a tool that works with normal AWS credentials but doesn't understand the new AWS SSO credentials, another option is to add a profile to.aws/configthat calls theaws2-wrapscript.For example, add the following block to.aws/config:[profile Wrapped]
credential_process = aws2-wrap --process --profile <awsprofilename>then, after authentication, you can run any command that uses AWS credentials by specifying the "Wrapped" profile:aws sso login --profile <awsprofilename>
export AWS_PROFILE=Wrapped
export AWS_SDK_LOAD_CONFIG=1
terraform planNote that because the profile is being specified viaAWS_PROFILE, it is sometimes necessary (as shown above) to setAWS_SDK_LOAD_CONFIGin order to get tools liketerraformto successfully retrieve the credentials.Assume a role via AWS SSOYour.aws/configfile can look like this:[default]
sso_start_url = xxxxxxxxxxxx
sso_region = us-west-2
sso_account_id = xxxxxxxxxxxx
sso_role_name = SSORoleName

[profile account1]
role_arn = arn:aws:iam::xxxxxxxxxxxx:role/role-to-be-assumed
source_profile = default
region = ap-northeast-1allowing you to then run:aws2-wrap --profile account1 <command>and<command>will be run underrole-to-be-assumed.ContributingContributions are more than welcome, particularly if you are able to expand on the test code. Please ensure, though, that before you submit a Pull Request, you runmake testto ensure that your changes don't break any of the existing tests andmake pylintto ensure that the linter is happy. Please note that the CI/CD pylint testmayuse different pylint rules from your own local setup.Please also note thatmake pylintwill only report errors. Youmaywant to explicitly runpython3 -m pylint setup.py aws2wrapCreditsThanks to @matan129, @nitrocode, @chenrui333, @l1n, @sodul, @damian-bisignano, @flyinprogrammer, @abeluck, @topu, @bigwheel, @krabbit, @jscook2345, @hieki, @blazdivjak, @fukushun1994, @johann8384, @ppezoldt, @atwoodjw, @lummish, @life36-vinny, @lukemassa and @axelri for their contributions.