Package: victorykit-aws-myfa
Create and maintain AWS CLI profiles requiring MFA-authenticated STS sessions
with ease.If you don’t know what this script is for, don’t waste your time, you’ll
probably won’t need it.A bad example:python3 aws-mfa-profile.py–mfa-device-arn “arn:aws:iam::XXXXXXXXXXXX:mfa/me”         –yesThis will use your default profile and overwrite it. You’ll have to get new
AWS IAM user access keys afterwards.Do this instead:python3 aws-mfa-profile.py”my-new-mfa-authenticated-profile-name” “my-mfa-device-owning-principal-profile-name” –mfa-device-arn “arn:aws:iam::XXXXXXXXXXXX:mfa/me”You will use the AWS CLI profile namedmy-mfa-device-owning-principal-profile-namefrom your ~/.aws/config file
to get an AWS STS session token and create or update a profile namedmy-new-mfa-authenticated-profile-name, which links to source profile in
~/.aws/credentials namedmy-new-mfa-authenticated-profile-name.Add the--yesflag to acknowledge all yes/no prompts.If you want to update an existing MFA profile you’ve already created, it is
sufficient to do the following:python3 aws-mfa-profile.py -y “my-new-mfa-authenticated-profile-name”View this help documentation:python3aws-mfa-profile.py--helpCreate a system daemon or shell script (CRON, etc.) to do this recurrently,
there is open-source software for virtual MFA devices to do this. Will your
security officer be mad at you for doing this? Probably… The point of MFA is,
to have multiple authentication factors from multiple systems. The greater the
separation between the systems, the better. Having both, a password and a
token-device on the same physical system is bad enough, but having it in the
same software system (e.g. like 1Password, Bitwarden, etc.) is really bad…
It’s annoying sometimes, but there is no better option as of yet.Use it at your own discretion, but try not to automate too much of the
authentication process, PLEASE!Want to extend the functionality? Make main() small again!usage: aws-myfa [-h] [--config FILE] [--yes] [--mfa-device-arn FILE] [--mfa-token-code TOKEN_CODE] [--credentials FILE] TARGET_PROFILE [PRINCIPAL_PROFILE]Positional ArgumentsNamed ArgumentsYour current AWS CLI profiles will be retained.Getting StartedThe following commands are required:python3pippipenv(Development)Next, install and make sure the command is available.$python3-mpipinstallvictorykit-aws-myfa$aws-myfa--helpAlternatively, you can clone the repository and install via pipenv$mkdiraws-myfa&&cd$_&&gitclonegit@bitbucket.org:victorykit/py-aws-myfa.git.$python3-mpipenvinstall-d$python3-mpipenvrunaws-myfa--helpThe documentation can be built through the pipenv enironment$python3-mpipenvrunhtmldocgen$python3-mpipenvrunmddocgenUsage ExamplesA bad example:aws-mfa\--mfa-device-arn"arn:aws:iam::XXXXXXXXXXXX:mfa/me"\--yesThis will use your default profile and overwrite it. You’ll have to get new
AWS IAM user access keys afterwards.Do this instead:aws-myfa\--mfa-device-arn'arn:aws:iam::XXXXXXXXXXXX:mfa/me'\'my-new-mfa-authenticated-profile-name'\'my-mfa-device-owning-principal-profile-name'\You will use the AWS CLI profile namedmy-mfa-device-owning-principal-profile-namefrom your ~/.aws/config file
to get an AWS STS session token and create or update a profile namedmy-new-mfa-authenticated-profile-name, which links to source profile in
~/.aws/credentials namedmy-new-mfa-authenticated-profile-name.Add the--yesflag to acknowledge all yes/no prompts.If you want to update an existing MFA profile you’ve already created, it is
sufficient to do the following:aws-myfa-y'my-new-mfa-authenticated-profile-name'View this help documentation:python3aws-myfa--helpCreate a system daemon or shell script (CRON, etc.) to do this recurrently,
there is open-source software for virtual MFA devices to do this. Will your
security officer be mad at you for doing this? Probably… The point of MFA is,
to have multiple authentication factors from multiple systems. The greater the
separation between the systems, the better. Having both, a password and a
token-device on the same physical system is bad enough, but having it in the
same software system (e.g. like 1Password, Bitwarden, etc.) is really bad…
It’s annoying sometimes, but there is no better option as of yet.LicenseDL-DE->BY-2.0

Datenlizenz Deutschland – Namensnennung – Version 2.0

(1) Jede Nutzung ist unter den Bedingungen dieser „Datenlizenz Deutschland – Namensnennung – Version 2.0" zulässig.

Die bereitgestellten Daten und Metadaten dürfen für die kommerzielle und nicht kommerzielle Nutzung insbesondere

vervielfältigt, ausgedruckt, präsentiert, verändert, bearbeitet sowie an Dritte übermittelt werden;
mit eigenen Daten und Daten Anderer zusammengeführt und zu selbständigen neuen Datensätzen verbunden werden;
in interne und externe Geschäftsprozesse, Produkte und Anwendungen in öffentlichen und nicht öffentlichen elektronischen Netzwerken eingebunden werden.

(2) Bei der Nutzung ist sicherzustellen, dass folgende Angaben als Quellenvermerk enthalten sind:

Bezeichnung des Bereitstellers nach dessen Maßgabe,
der Vermerk „Datenlizenz Deutschland – Namensnennung – Version 2.0" oder „dl-de/by-2-0" mit Verweis auf den Lizenztext unter www.govdata.de/dl-de/by-2-0 sowie
einen Verweis auf den Datensatz (URI).
Dies gilt nur soweit die datenhaltende Stelle die Angaben 1. bis 3. zum Quellenvermerk bereitstellt.

(3) Veränderungen, Bearbeitungen, neue Gestaltungen oder sonstige Abwandlungen sind im Quellenvermerk mit dem Hinweis zu versehen, dass die Daten geändert wurden.

Data licence Germany – attribution – version 2.0

(1) Any use will be permitted provided it fulfils the requirements of this "Data licence Germany – attribution – Version 2.0".

The data and meta-data provided may, for commercial and non-commercial use, in particular

be copied, printed, presented, altered, processed and transmitted to third parties;
be merged with own data and with the data of others and be combined to form new and independent datasets;
be integrated in internal and external business processes, products and applications in public and non-public electronic networks.

(2) The user must ensure that the source note contains the following information:

the name of the provider,
the annotation "Data licence Germany – attribution – Version 2.0" or "dl-de/by-2-0" referring to the licence text available at www.govdata.de/dl-de/by-2-0, and
a reference to the dataset (URI).
This applies only if the entity keeping the data provides the pieces of information 1-3 for the source note.

(3) Changes, editing, new designs or other amendments must be marked as such in the source note.

URL: http://www.govdata.de/dl-de/by-2-0