Package: byu-awslogin
AWSLOGINPython script for CLI and SDK access to AWS via ADFS while requiring MFA
access usinghttps://duo.com/History and PurposeBYU used to use the greataws-adfsCLI tool to login to our AWS accounts. It worked great, especially the
DUO 2FA support. Eventually, we decided to write our own similar tool
but make it BYU-specific so that we could tailor it to our needs (which
basically means hard-code certain BYU-specific things) and remove some
of the required parameters. Since this tool will be used by BYU
employees only we had that option. We then morphed it a little more for
our use cases. This isn't something that you could use outside of BYU,
sorry.DUO 2FA RequirementsIn order for Duo 2FA to work properly Automatic Push needs to be enabled.InstallationPython 3.6+ is recommended as python2 is EOL January 2020.It is highly recommended to use an application likePipxto install and use python cli applications.Follow the pipxinstallation documentationthen simply runpipx install byu_awsloginExperimental Binaries are available on the releases page. These are new and in testingReleasesSee theinstallation optionsFor additional options
page for step by step instructions for installing in various environmentsUpgradingIf you already have byu_awslogin install and are looking to upgrade
simply runpip3 install --upgrade byu_awsloginorpip install --upgrade byu_awsloginas appropriate for your python installationUsageawslogin defaults to the default profile in your ~/.aws/config and
~/.aws/credentials files.*If you already have a default profile you
want to save in your ~/.aws files make sure to do that before running
awslogin.*Once you're logged in, you can execute commands using the AWS CLI or AWS
SDK. Try runningaws s3 ls.Currently, AWS temporary credentials are only valid for 1 hour. We cache
your ADFS session, however, so you can just re-runawsloginagain to
get a new set of AWS credentials without logging in again to ADFS. Your
ADFS login session is valid for 8 hours, after which time you'll be
required to login to ADFS again to obtain a new session.To switch accounts after you've already authenticated to an account,
just run awslogin again and select a new account/role combination.To use it:Runawsloginand it will prompt you for the AWS account and role
to use.Runawslogin --account <account name> --role <role name>to skip
the prompting for account and name. You could specify just one of
the arguments as well.Runawslogin --profile <profile name>to specifiy an alternative
profileRunawslogin --region <region name>to specify a different region.
The default region isus-west-2.Runawslogin --statusfor the current status of the default
profileRunawslogin --status --profile devfor the current status of the
dev profileRunawslogin --status --profile allfor the current status of the
all profilesRunawslogin --logoutto logout of a cached ADFS sessionRunawslogin --versionto display the running version of awsloginRunawslogin --helpfor full help messageBash or ZSH CompletionBash:Run the following:_AWSLOGIN_COMPLETE=source awslogin > ~/_awsloginThen addsource /path/to/_awsloginto .bashrcZSH:Run the following:_AWSLOGIN_COMPLETE=source_zsh awslogin > ~/_awsloginThen addsource /path/to/_awsloginto .zshrcAlternatively put the_awsloginin your/etc/bash_completion.dor similiar directory (~/.zfunc) to load at shells startupTo test if it works run awslogin at least once for the account and role cache to populate. On next loginawslogin -a [TAB][TAB]should output available accounts andawslogin -a {some account} -r [TAB][TAB]should output available roles for the selected accountLimitation: Accounts and Role completion at the CLI is loaded from a cache file. This file will be updated anytime awslogin is ran.Reporting bugs or requesting featuresEnter an issue on the github repo.Or, even better if you can, fix the issue and make a pull request.Deploying changesUpdate the version inpyproject.tomland__version__.pyCommit the changes and push.Build binariesCreate a new release (add binaries and sha256sums.txt) with the version number and Github Actions will build, test and publishTODOWrite testsWrite more tests to increase overall coverage