--export with a new name

[iwpnd]

Hi folks 👋

Is there a way to export credentials but giving it a new name in the process?

Something like:

assume <profilname> --export-as <new-profilename>

Currently I have a profile that I use to request a token, and then use the resulting token to assume the other profiles. Currently I use the export, and change the name on the credential manually. I might be misunstanding a concept here completely, but this gets me to where I need to go.

If it is not something you currently support, would you be open to have me take a stab at adding it to granted? If I'm doing something wrong here, could someone please help me understand how to use granted for my scenario? 😄

kind regards

[simon-dk]

Second this. By default, CDK uses the default profile in ./aws/credentials, so using granted with CDK is not as smooth as it can get.

[simon-dk]

I made a small script to export env tokens to the credentials file.

It uses the aws cli to set/overwrite the tokens created by granted to the ./aws/credentials file. It uses "default" as the default profile, but can take a --profile / -p flag that overwrites this.

In conjunction with the assume command, we can quickly store permissions.

Create file and edit

sudo touch /usr/local/bin/aws-export
sudo nano /usr/local/bin/aws-export

Add the following content

#!/bin/bash -e

# Set default profile
PROFILE="default"

# Parse command line arguments
while [[ $# -gt 0 ]]; do
    case $1 in
        -p|--profile)
            PROFILE="$2"
            shift 2
            ;;
        *)
            echo "Unknown option: $1"
            echo "Usage: aws-export [-p|--profile PROFILE_NAME]"
            exit 1
            ;;
    esac
done

# Configure AWS credentials
aws configure --profile "$PROFILE" set aws_access_key_id "${AWS_ACCESS_KEY_ID}"
aws configure --profile "$PROFILE" set aws_secret_access_key "${AWS_SECRET_ACCESS_KEY}"
aws configure --profile "$PROFILE" set aws_session_token "${AWS_SESSION_TOKEN}"

echo "AWS credentials exported to profile: $PROFILE"

Save the file:
Press Ctrl + X to exit
Press Y to save changes
Press Enter to confirm

Alternative script

If you know you won't be using anything else than the default profile, you can use a simpler script:

#!/bin/bash -e

aws configure --profile default set aws_access_key_id "${AWS_ACCESS_KEY_ID}"
aws configure --profile default set aws_secret_access_key "${AWS_SECRET_ACCESS_KEY}"
aws configure --profile default set aws_session_token "${AWS_SESSION_TOKEN}"

echo "AWS credentials exported to profile: default"

Set file permissions

sudo chmod +x /usr/local/bin/aws-export

Usage

aws-export # Uses "default" profile
aws-export -p dev # Uses "dev" profile
aws-export --profile prod # Uses "prod" profile

Usage with granted / assume

assume && aws-export # select which profile to assume and export tokens to "default" profile
assume <profile> && aws-export # assume <profile> and export tokens to the "default" profile
assume <profile> && aws-export -p dev # assume <profile> and export tokens to the "dev" profile
assume <profile> && aws-export --profile prod # assume <profile> and export tokens to the "prod" profile

[iwpnd]

I ended up using a TEMU version of that. Native support would be nice tho. :)

[simon-dk]

Makes sense. Seems like a small change in this part would do the trick:

if assumeFlags.Bool("export") || cfg.ExportCredsToAWS {
	err = cfaws.ExportCredsToProfile(profile.Name, creds)
	if err != nil {
		return err
	}
	var profileName string
	if cfg.ExportCredentialSuffix != "" {
		profileName = profile.Name + "-" + cfg.ExportCredentialSuffix

	} else {
		profileName = profile.Name
		clio.Warn("No credential suffix found. This can cause issues with using exported credentials if conflicting profiles exist. Run `granted settings export-suffix set` to set one.")
	}

	credentialsFilePath := cfaws.GetAWSCredentialsPath()
	clio.Successf("Exported credentials to %s file as %s successfully", credentialsFilePath, profileName)
}

https://github.com/common-fate/granted/blob/e1f1b5ab75424d4534ac715c33d6d1049936e3ba/pkg/assume/assume.go#L583C1-L599C4

Not a go dev myself though, but maybe someone else will pick this up at some point.