Package: awsconsurl
AWS Console URLGenerates and launches an AWS console login URL in a new tab for the default browser.Installationpip install awsconsurlThis installs boto3 and Python requests. Consider you may prefer either a local installation or a virtual environment.Basic CommandIn basic usage:# consurlThis will use yourdefaultAWS profile (from~/.aws/credentials) to launch a console window in your default browser.The-hor--helpprints the command arguments summary and exits. Note that the help message includes the defaults as expressed in the current environment.  Example:$consurl-h
usage:consurl[-h][-V][-v][-pPROFILE][-o][-a][-sSHORT_ROLE_NAME][-rROLE_ARN][-nNAME][-dDURATION]OpenAWSConsoleinaBrowser

optionalarguments:-h,--helpshowthishelpmessageandexit-V,--versionPrintversionandexit.-v,--verboseVerboseoutput[False]-pPROFILE,--profilePROFILESpecifyAWSprofile[default]-o,--outputOnlyPrinttheURL[False]-a,--assume-roleAssumerolefirst[False]-sSHORT_ROLE_NAME,--short-role-nameSHORT_ROLE_NAMESpecifyrolenametoassume[DefaultConsoleRole]-rROLE_ARN,--role-arnROLE_ARN(optonal)fullarntoassume[None]-nNAME,--nameNAMESessionnameforassumerole[rkras-rkmbp.sunyocc.edu]-dDURATION,--durationDURATIONSpecifysessionduration[3600Sec]-------------------------The-Vor--versionprints the version information and exits.The-vor--verboseflag prints debug output tostderras the URL is created.The-oor--outputflag outputs the created console login URL tostdout, and does not launch the URL in the users browser.The-por--profilearguments specify a configured aws profile to use with the command,described below.The Remainder of the command arguments relate to (assuming a role and are described below.](README.md#Assuming_Roles)Selecting Credentialsconsurluses the AWSboto3library, and so includes the same basic behavior asawscliin using the AWScredentialsfile.consurlwill use the profile named inAWS_PROFILEenvironment varaible, orAWS_ACCESS_KEY_IDandAWS_SECRET_ACCESS_KEY. If no environment varailbes are set,consurlwill used configureddefaultprofile.A specific profile can be selected with the-pprofilename>or--profileprofilenamecommand arguments.  This is probably the most important switch for general use.# consurl -p sandboxcredsThe credentials profile named[sandboxcreds]will be used to launch the AWS console.These credentials will be used to obtain a console login token and a console login URL is created and used to launch the AWS console.Assuming Rolesconsurlis useful to open a console session with an assumed role. This can, with the correctiampermissions, launch a console in a different account than the users credentials.If you would like to assume a role, and use that roles temporary credentials for the console, use the-aor--assume-rolecommand switch.consurlwill assume the role defined inAWS_ROLE_ARNenvironment variable containing the fullARN(Amazon Resource Name) for the role.To override this use either the-rrole-arnor--role-arnrole-arnswitch to specify the role. This is the best methond for assuming cross-account roles:# consurl --assume-role --role-arn arn:aws:iam::123456789012:role/MyFavoriteRoleAlternatively, you can use the-sshort-role-nameor--short-role-nameshort-role-nameswitch. We define the short role name as the non-ARN name of the role.  The full ARN is generated for the AWS account of the users credentials.# consurl --assume-role -s MyFavoriteRoleFor credentials from account 123456789012 will create the role ARN arn:aws:iam::123456789012:role/MyFavoriteRoleIf--assume-roleflag is used, but neither switches nor environment strings define a role ARN, one is created with the nameDefaultConsoleRolein the account of the users credentials, andconsurlattempts to assume that role.If no--assume-roleflag is used, but either--role-arnor--short-role-nameare specifiedconsurlwill attempt to assume the role only if it is usingiamcredentials (i.e.the session isn't already running an assumed role or temporary credentials.)For assumed rolessession nameis retrieved from theAWS_ROLE_SESSION_NAMEenvironment variable, but this can be overriden with the-nsession-name>or--namesession-name>switch. If neither are specified a default is formed as[username]-[hostname]# consurl -a -s ITSRole -n "alice@example.org"This results in anassumed role userof arn:aws:sts::123456789012:assumed-role/ITSRole/alice@example.org- which can assure a consistent principle to use in IAM policies.The-dsecondsor--durationsecondsswitch provide the duration in Seconds for the assumed role to be valid, with the default of 3600 seconds.  For Assumed roles the maximum is set in the IAM role.