dc4692b53e4a1dc512d405f36f2d2af30c66304b

Message

fix(aws): fix acp function for MFA without role and other fixes (#9426)

* fix(aws): don't duplicate aws_prompt_info function in RPROMPT

* refactor(aws): clean up logic in acp function and fix session duration input

Fixes #9409

Diff

This diff is truncated to protect this page.

  1diff --git a/plugins/aws/aws.plugin.zsh b/plugins/aws/aws.plugin.zsh
  2index e6959759e38868fa785a8a17f4e486796f36f23c..ef435fe3b30cead5bc403386770cf49f6f5f4182 100644
  3--- a/plugins/aws/aws.plugin.zsh
  4+++ b/plugins/aws/aws.plugin.zsh
  5@@ -26,7 +26,8 @@ function asp() {
  6 # AWS profile switch
  7 function acp() {
  8   if [[ -z "$1" ]]; then
  9-    unset AWS_DEFAULT_PROFILE AWS_PROFILE AWS_EB_PROFILE AWS_ACCESS_KEY_ID AWS_SECRET_ACCESS_KEY AWS_SESSION_TOKEN
 10+    unset AWS_DEFAULT_PROFILE AWS_PROFILE AWS_EB_PROFILE
 11+    unset AWS_ACCESS_KEY_ID AWS_SECRET_ACCESS_KEY AWS_SESSION_TOKEN
 12     echo AWS profile cleared.
 13     return
 14   fi
 15@@ -39,73 +40,79 @@ function acp() {
 16     return 1
 17   fi
 18 
 19-  local aws_access_key_id="$(aws configure get aws_access_key_id --profile $1)"
 20-  local aws_secret_access_key="$(aws configure get aws_secret_access_key --profile $1)"
 21-  local aws_session_token="$(aws configure get aws_session_token --profile $1)"
 22-  local mfa_serial="$(aws configure get mfa_serial --profile $1)"
 23-  local role_arn="$(aws configure get role_arn --profile $1)"
 24+  local profile="$1"
 25+
 26+  # Get fallback credentials for if the aws command fails or no command is run
 27+  local aws_access_key_id="$(aws configure get aws_access_key_id --profile $profile)"
 28+  local aws_secret_access_key="$(aws configure get aws_secret_access_key --profile $profile)"
 29+  local aws_session_token="$(aws configure get aws_session_token --profile $profile)"
 30+
 31 
 32   # First, if the profile has MFA configured, lets get the token and session duration
 33-  local mfa_opt=""
 34+  local mfa_serial="$(aws configure get mfa_serial --profile $profile)"
 35 
 36-  if [[ -n $mfa_serial ]]; then
 37-    local mfa_token=""
 38-    echo "Please enter your MFA token for $mfa_serial:"
 39+  if [[ -n "$mfa_serial" ]]; then
 40+    local -a mfa_opt
 41+    local mfa_token sess_duration
 42+    echo -n "Please enter your MFA token for $mfa_serial: "
 43     read -r mfa_token
 44-    echo "Please enter the session duration in seconds (900-43200; default: 3600, which is the default maximum for a role):"
 45+    echo -n "Please enter the session duration in seconds (900-43200; default: 3600, which is the default maximum for a role): "
 46     read -r sess_duration
 47-    if [[ -z $sess_duration ]]; then
 48-      sess_duration="3600"
 49-    fi
 50-    mfa_opt="--serial-number $mfa_serial --token-code $mfa_token --duration-seconds $sess_duration"
 51-  fi
 52+    mfa_opt=(--serial-number "$mfa_serial" --token-code "$mfa_token" --duration-seconds "${sess_duration:-3600}")
 53 
 54-  # Now see whether we need to just MFA for the current role, or assume a different one
 55-  local credentials_output=""
 56-  if [[ -n $role_arn ]]; then
 57-    # Means we need to assume a specified role
 58+    # Now see whether we need to just MFA for the current role, or assume a different one
 59+    local role_arn="$(aws configure get role_arn --profile $profile)"
 60 
 61-    # Check whether external_id is configured to use while assuming the role
 62-    local ext_id="$(aws configure get external_id --profile $1)"
 63-    local extid_opt=""
 64-    if [[ -n $ext_id ]]; then
 65-      extid_opt="--external-id $ext_id"
 66-    fi
 67+    if [[ -n "$role_arn" ]]; then
 68+      # Means we need to assume a specified role
 69+      aws_command=(aws sts assume-role --role-arn "$role_arn" "${mfa_opt[@]}")
 70+
 71+      # Check whether external_id is configured to use while assuming the role
 72+      local external_id="$(aws configure get external_id --profile "$profile")"
 73+      if [[ -n "$external_id" ]]; then
 74+        aws_command+=(--external-id "$external_id")
 75+      fi
 76+
 77+      # Get source profile to use to assume role
 78+      local source_profile="$(aws configure get source_profile --profile "$profile")"
 79+      aws_command+=(--profile="${source_profile:-profile}" --role-session-name "${source_profile:-profile}")
 80 
 81-    # Get source profile to use to assume role
 82-    local profile=$1
 83-    local source_profile="$(aws configure get source_profile --profile "$1")"
 84-    if [[ -n $source_profile ]]; then
 85-      profile=$source_profile
 86+      echo "Assuming role $role_arn using profile ${source_profile:-profile}"
 87+    else
 88+      # Means we only need to do MFA
 89+      aws_command=(aws sts get-session-token --profile="$profile" "${mfa_opt[@]}")
 90+      echo "Obtaining session token for profile $profile"
 91     fi
 92 
 93-    echo "Assuming role $role_arn using profile $profile"
 94-    local assume_cmd=(aws sts assume-role "--profile=$profile" "--role-arn $role_arn" "--role-session-name $profile" "$mfa_opt" "$extid_opt"
 95-      "--query '[Credentials.AccessKeyId,Credentials.SecretAccessKey,Credentials.SessionToken]' --output text | tr '\t' '\n'")
 96-    credentials_output="$(eval "${assume_cmd[@]}")"
 97-  elif [[ -n $mfa_opt ]]; then
 98-    # Means we only need to do MFA
 99-    echo "Obtaining session token for profile $profile"
100-    local get_token_cmd=(aws sts get-session-token "--profile=$profile" "$mfa_opt"
101-      "--query '[Credentials.AccessKeyId,Credentials.SecretAccessKey,Credentials.SessionToken]' --output text | tr '\t' '\n'")
102-    credentials_output="$(eval "${get_token_cmd[@]}")"
103-  fi
104+    # Format output of aws command for easier processing