Skip to content

Commit 4283a15

Browse files
LozanoMatheusLozanoMatheus
authored
Merge pull request #1 from LozanoMatheus/first-release
First release of awsecure-cli
2 parents 73c4849 + 4cc0149 commit 4283a15

File tree

9 files changed

+459
-0
lines changed

9 files changed

+459
-0
lines changed

‎.github/workflows/main.yml‎

Lines changed: 55 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,55 @@
1+
name: "Build and Release"
2+
on:
3+
push:
4+
branches:
5+
- main
6+
7+
jobs:
8+
build:
9+
runs-on: ubuntu-latest
10+
steps:
11+
- uses: actions/checkout@v3
12+
with:
13+
fetch-depth: '0'
14+
15+
- name: Set changelog
16+
id: set-changelog
17+
run: |
18+
ARRAY_SIZE="$(jq -r '.event.commits[] | @base64' <<< '${{ toJSON(github) }}')"
19+
20+
for i in ${ARRAY_SIZE}; do
21+
MY_COMMIT_MSG="$(base64 -d <<< "${i}" | jq -c ".message" | sed -E 's/^"|"$//g')"
22+
MY_COMMIT_ID="$(base64 -d <<< "${i}" | jq -r ".id[0:7]")"
23+
MY_COMMIT_URL="$(base64 -d <<< "${i}" | jq -r ".url")"
24+
MY_COMMIT_AUTHOR="$(base64 -d <<< "${i}" | jq -r ".author.username")"
25+
CHANGELOG+="$(echo -n "* [${MY_COMMIT_ID}](${MY_COMMIT_URL}) ${MY_COMMIT_MSG//\\n/\\\\n} @${MY_COMMIT_AUTHOR}\n")"
26+
done
27+
28+
echo "CHANGELOG<<EOF" >> $GITHUB_ENV
29+
echo -e "$CHANGELOG" >> $GITHUB_ENV
30+
echo "EOF" >> $GITHUB_ENV
31+
32+
- name: Bump version
33+
id: bump-version
34+
uses: anothrnick/github-tag-action@1.35.0
35+
env:
36+
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
37+
WITH_V: true
38+
RELEASE_BRANCHES: main
39+
DEFAULT_BUMP: minor
40+
41+
- name: Create release
42+
uses: softprops/action-gh-release@v1
43+
env:
44+
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
45+
with:
46+
name: ${{ steps.bump-version.outputs.tag }}
47+
tag_name: ${{ steps.bump-version.outputs.tag }}
48+
draft: false
49+
prerelease: false
50+
fail_on_unmatched_files: true
51+
body: |
52+
## What's Changed
53+
${{ env.CHANGELOG }}
54+
55+
Full Changelog: ${{ github.event.compare }}

‎LICENSE‎

Lines changed: 21 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,21 @@
1+
MIT License
2+
3+
Copyright (c) 2022 Matheus Lozano
4+
5+
Permission is hereby granted, free of charge, to any person obtaining a copy
6+
of this software and associated documentation files (the "Software"), to deal
7+
in the Software without restriction, including without limitation the rights
8+
to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
9+
copies of the Software, and to permit persons to whom the Software is
10+
furnished to do so, subject to the following conditions:
11+
12+
The above copyright notice and this permission notice shall be included in all
13+
copies or substantial portions of the Software.
14+
15+
THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
16+
IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
17+
FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
18+
AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
19+
LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
20+
OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
21+
SOFTWARE.

‎bin/bash/aws‎

Lines changed: 25 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,25 @@
1+
#!/usr/bin/env bash
2+
3+
set -eo pipefail
4+
5+
[[ ! -z "${AWSECURE_CLI_AWS_BIN_FILEPATH}" ]] && declare -x AWSECURE_CLI_AWS_BIN_FILEPATH_TMP="${AWSECURE_CLI_AWS_BIN_FILEPATH}"
6+
[[ ! -z "${AWSECURE_CLI_MUTED}" ]] && declare -lx AWSECURE_CLI_MUTED_TMP="${AWSECURE_CLI_MUTED}"
7+
[[ ! -z "${AWSECURE_CLI_AUTOROTATE_AWS_ACCESS_KEYS}" ]] && declare -lx AWSECURE_CLI_AUTOROTATE_AWS_ACCESS_KEYS_TMP="${AWSECURE_CLI_AUTOROTATE_AWS_ACCESS_KEYS}"
8+
[[ ! -z "${AWSECURE_CLI_AUTOROTATE_PERIOD}" ]] && declare -lx AWSECURE_CLI_AUTOROTATE_PERIOD_TMP="${AWSECURE_CLI_AUTOROTATE_PERIOD}"
9+
[[ ! -z "${AWSECURE_CLI_AUTOROTATE_CHECK}" ]] && declare -lx AWSECURE_CLI_AUTOROTATE_CHECK_TMP="${AWSECURE_CLI_AUTOROTATE_CHECK}"
10+
11+
. ~/.awsecure-cli
12+
13+
[[ ! -z "${AWSECURE_CLI_AWS_BIN_FILEPATH_TMP}" ]] && declare -gx AWSECURE_CLI_AWS_BIN_FILEPATH="${AWSECURE_CLI_AWS_BIN_FILEPATH_TMP:-$AWSECURE_CLI_AWS_BIN_FILEPATH}"
14+
[[ ! -z "${AWSECURE_CLI_MUTED_TMP}" ]] && declare -glx AWSECURE_CLI_MUTED="${AWSECURE_CLI_MUTED_TMP:-$AWSECURE_CLI_MUTED}"
15+
[[ ! -z "${AWSECURE_CLI_AUTOROTATE_AWS_ACCESS_KEYS_TMP}" ]] && declare -glx AWSECURE_CLI_AUTOROTATE_AWS_ACCESS_KEYS="${AWSECURE_CLI_AUTOROTATE_AWS_ACCESS_KEYS_TMP:-$AWSECURE_CLI_AUTOROTATE_AWS_ACCESS_KEYS}"
16+
[[ ! -z "${AWSECURE_CLI_AUTOROTATE_PERIOD_TMP}" ]] && declare -glx AWSECURE_CLI_AUTOROTATE_PERIOD="${AWSECURE_CLI_AUTOROTATE_PERIOD_TMP:-$AWSECURE_CLI_AUTOROTATE_PERIOD}"
17+
[[ ! -z "${AWSECURE_CLI_AUTOROTATE_CHECK_TMP}" ]] && declare -glx AWSECURE_CLI_AUTOROTATE_CHECK="${AWSECURE_CLI_AUTOROTATE_CHECK_TMP:-$AWSECURE_CLI_AUTOROTATE_CHECK}"
18+
19+
if [[ $(type awsecure_cli_log_info 2> /dev/null) == "" || -z "${AWSECURE_CLI_SRC_DIRECTORY// /}" ]]; then
20+
[[ -L ${0} ]] && declare -gr AWSECURE_CLI_SRC_DIRECTORY="$(realpath $(readlink ${0}) | xargs dirname)/../../src" || declare -gr AWSECURE_CLI_SRC_DIRECTORY="$(realpath ${0} | xargs dirname)/../../src"
21+
. ${AWSECURE_CLI_SRC_DIRECTORY}/common/logging.shinc
22+
fi
23+
24+
awsecure_cli_log_info "Using the AWSecure CLI wrapper"
25+
. ${AWSECURE_CLI_SRC_DIRECTORY}/common/wrapper.sh

‎bin/zsh/aws‎

Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,13 @@
1+
#!/usr/bin/env zsh
2+
3+
set -eo pipefail
4+
5+
. ~/.awsecure-cli
6+
7+
if [[ $(type awsecure_cli_log_info 2> /dev/null) == "" || -z "${AWSECURE_CLI_SRC_DIRECTORY// /}" ]]; then
8+
[[ -L ${0} ]] && declare -gr AWSECURE_CLI_SRC_DIRECTORY="$(realpath $(readlink ${0}) | xargs dirname)/../../src" || declare -gr AWSECURE_CLI_SRC_DIRECTORY="$(realpath ${0} | xargs dirname)/../../src"
9+
. ${AWSECURE_CLI_SRC_DIRECTORY}/common/logging.shinc
10+
fi
11+
12+
awsecure_cli_log_info "Using the AWSecure CLI wrapper"
13+
. ${AWSECURE_CLI_SRC_DIRECTORY}/common/wrapper.sh

‎src/bash/validate-prereqs.sh‎

Lines changed: 30 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,30 @@
1+
#!/usr/bin/env bash
2+
3+
set -eo pipefail
4+
5+
function awsecure_cli_validate_commands() {
6+
local -rl AWSECURE_CLI_VALIDATE_COMMANDS="jq ${AWSECURE_CLI_AWS_BIN_FILEPATH} ${AWSECURE_CLI_SH_INTERPRETER}"
7+
for cmd in ${AWSECURE_CLI_VALIDATE_COMMANDS}; do
8+
awsecure_cli_log_info "Testing if ${cmd} is installed"
9+
${cmd} --version &> /dev/null || awsecure_cli_log_error "The ${cmd} is not installed or not in the PATH environment variable"
10+
done
11+
}
12+
13+
case "${AWSECURE_CLI_OS_NAME// /}" in
14+
darwin)
15+
true
16+
;;
17+
linux)
18+
true
19+
;;
20+
*)
21+
awsecure_cli_log_error "OS not supported"
22+
;;
23+
esac
24+
25+
awsecure_cli_validate_commands
26+
27+
set +eo pipefail
28+
${AWSECURE_CLI_AWS_BIN_FILEPATH} configure get aws_access_key_id > /dev/null 2>&1
29+
[[ $? -ne 0 ]] && { awsecure_cli_log_info "The profile ${AWS_PROFILE} is not using an AWS access key, skipping AWS access key rotation" ; SKIP_AWSECURE_CLI_AUTOROTATE_AWS_ACCESS_KEYS=true ; }
30+
set -eo pipefail

‎src/common/autorotate_aws_keys.sh‎

Lines changed: 205 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,205 @@
1+
#!/usr/bin/env bash
2+
3+
set -eo pipefail
4+
5+
[[ ! -z "${AWSECURE_CLI_AWS_BIN_FILEPATH}" ]] && declare -x AWSECURE_CLI_AWS_BIN_FILEPATH_TMP="${AWSECURE_CLI_AWS_BIN_FILEPATH}"
6+
[[ ! -z "${AWSECURE_CLI_MUTED}" ]] && declare -lx AWSECURE_CLI_MUTED_TMP="${AWSECURE_CLI_MUTED}"
7+
[[ ! -z "${AWSECURE_CLI_AUTOROTATE_AWS_ACCESS_KEYS}" ]] && declare -lx AWSECURE_CLI_AUTOROTATE_AWS_ACCESS_KEYS_TMP="${AWSECURE_CLI_AUTOROTATE_AWS_ACCESS_KEYS}"
8+
[[ ! -z "${AWSECURE_CLI_AUTOROTATE_PERIOD}" ]] && declare -lx AWSECURE_CLI_AUTOROTATE_PERIOD_TMP="${AWSECURE_CLI_AUTOROTATE_PERIOD}"
9+
[[ ! -z "${AWSECURE_CLI_AUTOROTATE_CHECK}" ]] && declare -lx AWSECURE_CLI_AUTOROTATE_CHECK_TMP="${AWSECURE_CLI_AUTOROTATE_CHECK}"
10+
11+
. ~/.awsecure-cli
12+
13+
[[ ! -z "${AWSECURE_CLI_AWS_BIN_FILEPATH_TMP}" ]] && declare -gx AWSECURE_CLI_AWS_BIN_FILEPATH="${AWSECURE_CLI_AWS_BIN_FILEPATH_TMP:-$AWSECURE_CLI_AWS_BIN_FILEPATH}"
14+
[[ ! -z "${AWSECURE_CLI_MUTED_TMP}" ]] && declare -glx AWSECURE_CLI_MUTED="${AWSECURE_CLI_MUTED_TMP:-$AWSECURE_CLI_MUTED}"
15+
[[ ! -z "${AWSECURE_CLI_AUTOROTATE_AWS_ACCESS_KEYS_TMP}" ]] && declare -glx AWSECURE_CLI_AUTOROTATE_AWS_ACCESS_KEYS="${AWSECURE_CLI_AUTOROTATE_AWS_ACCESS_KEYS_TMP:-$AWSECURE_CLI_AUTOROTATE_AWS_ACCESS_KEYS}"
16+
[[ ! -z "${AWSECURE_CLI_AUTOROTATE_PERIOD_TMP}" ]] && declare -glx AWSECURE_CLI_AUTOROTATE_PERIOD="${AWSECURE_CLI_AUTOROTATE_PERIOD_TMP:-$AWSECURE_CLI_AUTOROTATE_PERIOD}"
17+
[[ ! -z "${AWSECURE_CLI_AUTOROTATE_CHECK_TMP}" ]] && declare -glx AWSECURE_CLI_AUTOROTATE_CHECK="${AWSECURE_CLI_AUTOROTATE_CHECK_TMP:-$AWSECURE_CLI_AUTOROTATE_CHECK}"
18+
19+
if [[ $(type awsecure_cli_log_info 2> /dev/null) == "" || -z "${AWSECURE_CLI_SRC_DIRECTORY// /}" ]]; then
20+
[[ -L ${0} ]] && declare -gr AWSECURE_CLI_SRC_DIRECTORY="$(realpath $(readlink ${0}) | xargs dirname)/../../src" || declare -gr AWSECURE_CLI_SRC_DIRECTORY="$(realpath ${0} | xargs dirname)/../../src"
21+
. ${AWSECURE_CLI_SRC_DIRECTORY}/common/logging.shinc
22+
fi
23+
24+
if [[ ! -z "${ZSH_NAME}" ]]; then
25+
declare -lr AWSECURE_CLI_SH_INTERPRETER="zsh"
26+
elif [[ ! -z "${BASH}" ]]; then
27+
declare -lr AWSECURE_CLI_SH_INTERPRETER="bash"
28+
else
29+
awsecure_cli_log_error "SH Interpreter not supported or not defined"
30+
fi
31+
32+
declare -lrx AWSECURE_CLI_OS_NAME="$(uname -s)"
33+
34+
function awsecure_cli_date_format() {
35+
date -u "${@}" +"%s"
36+
}
37+
38+
function awsecure_cli_aws_access_keys_not_older_than() {
39+
case "${AWSECURE_CLI_OS_NAME// /}" in
40+
darwin)
41+
awsecure_cli_date_format -v "-${AWSECURE_CLI_AUTOROTATE_PERIOD// /}H"
42+
;;
43+
linux)
44+
awsecure_cli_date_format -d "now - ${AWSECURE_CLI_AUTOROTATE_PERIOD// /} hours"
45+
;;
46+
*)
47+
echo "Unknown OS"
48+
;;
49+
esac
50+
}
51+
52+
function awsecure_cli_get_aws_access_keys() {
53+
${AWSECURE_CLI_AWS_BIN_FILEPATH} --output json iam list-access-keys
54+
}
55+
56+
function awsecure_cli_get_aws_access_key_age() {
57+
jq -r '.AccessKeyMetadata[0].CreateDate' <<< ${AWSECURE_CLI_GET_AWS_ACCESS_KEYS} | sed 's/+.*//'
58+
}
59+
60+
function awsecure_cli_get_aws_access_first_key_id() {
61+
jq -r '.AccessKeyMetadata[0].AccessKeyId' <<< ${AWSECURE_CLI_GET_AWS_ACCESS_KEYS}
62+
}
63+
64+
function awsecure_cli_validate_aws_access_key() {
65+
: "${AWSECURE_CLI_CREATED_AWS_ACCESS_KEY:?"Variable not set or empty"}"
66+
67+
jq -r '.AccessKey.Status' <<< "${AWSECURE_CLI_CREATED_AWS_ACCESS_KEY}" | grep "^Active$" &> /dev/null
68+
69+
awsecure_cli_get_aws_access_keys | jq -r ".AccessKeyMetadata[] | select(.AccessKeyId == \"${AWSECURE_CLI_NEW_AWS_ACCESS_KEY_ID}\").Status" | grep "^Active$" &> /dev/null
70+
}
71+
72+
function awsecure_cli_disable_old_access_key() {
73+
awsecure_cli_log_info "Disabling the old AWS key from AWS"
74+
sleep 10
75+
${AWSECURE_CLI_AWS_BIN_FILEPATH} iam update-access-key --access-key-id "${AWSECURE_CLI_GET_CURRENT_AWS_ACCESS_KEY_ID// /}" --status Inactive
76+
}
77+
78+
function awsecure_cli_remove_old_access_key() {
79+
awsecure_cli_log_info "Deleting the old AWS key from AWS"
80+
sleep 10
81+
${AWSECURE_CLI_AWS_BIN_FILEPATH} iam delete-access-key --access-key-id "${AWSECURE_CLI_GET_CURRENT_AWS_ACCESS_KEY_ID// /}"
82+
}
83+
84+
function awsecure_cli_change_aws_config_file() {
85+
awsecure_cli_log_info "Getting the AWS_ACCESS_KEY_ID in use"
86+
local -r AWSECURE_CLI_GET_CURRENT_AWS_ACCESS_KEY_ID="$(${AWSECURE_CLI_AWS_BIN_FILEPATH} configure get aws_access_key_id)"
87+
: "${AWSECURE_CLI_GET_CURRENT_AWS_ACCESS_KEY_ID:?"Variable not set or empty"}"
88+
89+
awsecure_cli_log_info "Getting the AWS_SECRET_ACCESS_KEY in use"
90+
local -r AWSECURE_CLI_GET_CURRENT_AWS_SECRET_ACCESS_KEY="$(${AWSECURE_CLI_AWS_BIN_FILEPATH} configure get aws_secret_access_key | sed 's,\+,\\+,g')"
91+
: "${AWSECURE_CLI_GET_CURRENT_AWS_SECRET_ACCESS_KEY:?"Variable not set or empty"}"
92+
93+
[[ ${AWSECURE_CLI_OS_NAME} == "darwin" ]] && local -r AWSECURE_CLI_SED_CMD=" "
94+
95+
awsecure_cli_log_info "Setting the new AWS_ACCESS_KEY_ID and disabling the old AWS_ACCESS_KEY_ID in the AWS config file ${AWS_CONFIG_FILE}"
96+
sed -i${AWSECURE_CLI_SED_CMD}'' -E "s,(${AWSECURE_CLI_GET_CURRENT_AWS_ACCESS_KEY_ID}),${AWSECURE_CLI_NEW_AWS_ACCESS_KEY_ID}\n# AWS_ACCESS_KEY_ID = \\1," ${AWS_CONFIG_FILE}
97+
98+
awsecure_cli_log_info "Setting the new AWS_SECRET_ACCESS_KEY and disabling the old AWS_SECRET_ACCESS_KEY in the AWS config file ${AWS_CONFIG_FILE}"
99+
sed -i${AWSECURE_CLI_SED_CMD}'' -E "s,(${AWSECURE_CLI_GET_CURRENT_AWS_SECRET_ACCESS_KEY}),${NEW_AWS_SECRET_ACCESS_KEY}\n# AWS_SECRET_ACCESS_KEY = \\1," ${AWS_CONFIG_FILE}
100+
101+
awsecure_cli_disable_old_access_key
102+
awsecure_cli_remove_old_access_key
103+
}
104+
105+
function awsecure_cli_rotate_aws_access_key() {
106+
awsecure_cli_log_info "Creating a new AWS keys"
107+
local -r AWSECURE_CLI_CREATED_AWS_ACCESS_KEY="$(${AWSECURE_CLI_AWS_BIN_FILEPATH} --output json iam create-access-key)"
108+
: "${AWSECURE_CLI_CREATED_AWS_ACCESS_KEY:?"Variable not set or empty"}"
109+
110+
awsecure_cli_log_info "Getting the new AWS_ACCESS_KEY_ID"
111+
local -r AWSECURE_CLI_NEW_AWS_ACCESS_KEY_ID="$(jq -r '.AccessKey.AccessKeyId' <<< ${AWSECURE_CLI_CREATED_AWS_ACCESS_KEY})"
112+
: "${AWSECURE_CLI_NEW_AWS_ACCESS_KEY_ID:?"Variable not set or empty"}"
113+
114+
awsecure_cli_log_info "Getting the new AWS_SECRET_ACCESS_KEY"
115+
local -r NEW_AWS_SECRET_ACCESS_KEY="$(jq -r '.AccessKey.SecretAccessKey' <<< ${AWSECURE_CLI_CREATED_AWS_ACCESS_KEY})"
116+
: "${NEW_AWS_SECRET_ACCESS_KEY:?"Variable not set or empty"}"
117+
118+
awsecure_cli_log_info "Validating the new AWS_SECRET_ACCESS_KEY"
119+
awsecure_cli_validate_aws_access_key
120+
121+
awsecure_cli_log_info "Changing your AWS_CONFIG_FILE"
122+
awsecure_cli_change_aws_config_file
123+
}
124+
125+
function awsecure_cli_create_autorotate_state_file() {
126+
set -eo pipefail
127+
${AWSECURE_CLI_STATE_FILE_OPTION} ${AWSECURE_CLI_AUTOROTATE_STATE_FILE// /} &> /dev/null
128+
}
129+
130+
function awsecure_cli_autorotate_aws_access_keys() {
131+
. ${AWSECURE_CLI_SRC_DIRECTORY}/${AWSECURE_CLI_SH_INTERPRETER}/validate-prereqs.sh
132+
[[ "${SKIP_AWSECURE_CLI_AUTOROTATE_AWS_ACCESS_KEYS}" = "true" ]] && return 0
133+
134+
local -r AWS_CONFIG_FILE=${AWS_CONFIG_FILE:-~/.aws/credentials}
135+
136+
local -r AWSECURE_CLI_AUTOROTATE_PERIOD="${AWSECURE_CLI_AUTOROTATE_PERIOD:-"168"}"
137+
local -r AWSECURE_CLI_AWS_ACCESS_KEYS_NOT_OLDER_THAN=$(awsecure_cli_aws_access_keys_not_older_than)
138+
: "${AWSECURE_CLI_AWS_ACCESS_KEYS_NOT_OLDER_THAN:?"Variable not set or empty"}"
139+
140+
local -r AWSECURE_CLI_GET_AWS_ACCESS_KEYS="$(awsecure_cli_get_aws_access_keys)"
141+
: "${AWSECURE_CLI_GET_AWS_ACCESS_KEYS:?"Variable not set or empty"}"
142+
143+
case "${AWSECURE_CLI_OS_NAME// /}" in
144+
darwin)
145+
local -r AWSECURE_CLI_FIRST_AWS_ACCESS_KEY_AGE="$(awsecure_cli_get_aws_access_key_age | xargs -I{} ${AWSECURE_CLI_SH_INTERPRETER} -c "$(declare -f awsecure_cli_date_format) ; awsecure_cli_date_format -jf%Y-%m-%dT%H:%M:%S {}")"
146+
: "${AWSECURE_CLI_FIRST_AWS_ACCESS_KEY_AGE:?"Variable not set or empty"}"
147+
;;
148+
linux)
149+
local -r AWSECURE_CLI_FIRST_AWS_ACCESS_KEY_AGE="$(awsecure_cli_get_aws_access_key_age | xargs -I{} ${AWSECURE_CLI_SH_INTERPRETER} -c "$(declare -f awsecure_cli_date_format) ; awsecure_cli_date_format -d {}")"
150+
: "${AWSECURE_CLI_FIRST_AWS_ACCESS_KEY_AGE:?"Variable not set or empty"}"
151+
;;
152+
*)
153+
echo "Unknown OS"
154+
;;
155+
esac
156+
157+
local -r AWSECURE_CLI_FIRST_ACCESS_KEY_ID="$(awsecure_cli_get_aws_access_first_key_id)"
158+
159+
if [[ ${AWSECURE_CLI_AWS_ACCESS_KEYS_NOT_OLDER_THAN} -gt ${AWSECURE_CLI_FIRST_AWS_ACCESS_KEY_AGE} ]]; then
160+
awsecure_cli_log_info "Your key ${AWSECURE_CLI_FIRST_ACCESS_KEY_ID} is older than ${AWSECURE_CLI_AUTOROTATE_PERIOD// /} hours"
161+
awsecure_cli_log_info "Starting renewing your access key ${AWSECURE_CLI_FIRST_ACCESS_KEY_ID}"
162+
awsecure_cli_rotate_aws_access_key
163+
else
164+
awsecure_cli_log_info "No need to renew the access keys ${AWSECURE_CLI_FIRST_ACCESS_KEY_ID}, it's newer than ${AWSECURE_CLI_AUTOROTATE_PERIOD// /} hours"
165+
fi
166+
167+
set +eo pipefail
168+
[[ ! -z "${AWSECURE_CLI_STATE_FILE_OPTION// /}" ]] && awsecure_cli_create_autorotate_state_file
169+
set -eo pipefail
170+
}
171+
172+
function awsecure_cli_autorotate_check() {
173+
local -rl AWSECURE_CLI_AUTOROTATE_STATE_FILE=~/.awsecure-cli-state-file-${AWS_PROFILE// /}
174+
local -rl AWSECURE_CLI_AUTOROTATE_CHECK="${AWSECURE_CLI_AUTOROTATE_CHECK:-"daily"}"
175+
176+
case "${AWSECURE_CLI_AUTOROTATE_CHECK// /}" in
177+
daily)
178+
local -r AWSECURE_CLI_STATE_FILE_OPTION="touch"
179+
set +eo pipefail
180+
local -r FIND_AWSECURE_CLI_AUTOROTATE_STATE_FILE_CMD="$(find ${AWSECURE_CLI_AUTOROTATE_STATE_FILE} -type f -ctime +24h 2> /dev/null | grep . > /dev/null 2>&1 ; echo $?)"
181+
set -eo pipefail
182+
if [[ ! -f ${AWSECURE_CLI_AUTOROTATE_STATE_FILE} ]]; then
183+
awsecure_cli_autorotate_aws_access_keys
184+
elif [[ ${FIND_AWSECURE_CLI_AUTOROTATE_STATE_FILE_CMD} -eq 0 ]]; then
185+
set -eo pipefail
186+
awsecure_cli_autorotate_aws_access_keys
187+
else
188+
awsecure_cli_log_info "AWS Access Keys autorotate was already checked in the last 24h"
189+
fi
190+
set -eo pipefail
191+
;;
192+
on-reboot)
193+
local -r AWSECURE_CLI_STATE_FILE_OPTION="mktemp"
194+
[[ ! -f ${AWSECURE_CLI_AUTOROTATE_STATE_FILE} ]] && awsecure_cli_autorotate_aws_access_keys || awsecure_cli_log_info "AWS Access Keys autorotate was already checked since the last time you reboot the machine"
195+
;;
196+
always)
197+
local -r AWSECURE_CLI_STATE_FILE_OPTION=""
198+
awsecure_cli_autorotate_aws_access_keys
199+
;;
200+
*)
201+
awsecure_cli_log_info "The option ${AWSECURE_CLI_AUTOROTATE_CHECK} is unknown"
202+
;;
203+
esac
204+
}
205+
awsecure_cli_autorotate_check

‎src/common/logging.shinc‎

Lines changed: 27 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,27 @@
1+
declare -lr AWSECURE_CLI_LOG_FILEPATH=/tmp/awsecure-cli.log.$(date +'%Y%m%d')
2+
[[ ! -f "${AWSECURE_CLI_LOG_FILEPATH// /}" ]] && mktemp ${AWSECURE_CLI_LOG_FILEPATH} &> /dev/null
3+
declare -l AWSECURE_CLI_MUTED="${AWSECURE_CLI_MUTED:-"false"}"
4+
declare -l AWSECURE_CLI_LOG_TO_FILE="${AWSECURE_CLI_LOG_TO_FILE:-"false"}"
5+
6+
function awsecure_cli_log_info() {
7+
case "${AWSECURE_CLI_MUTED// /}-${AWSECURE_CLI_LOG_TO_FILE// /}" in
8+
false-true)
9+
echo "$(date +'%Y-%m-%d %T')Z INFO ${@}" ${AWSECURE_CLI_LOG_TO_FILE_CMD} | tee -a ${AWSECURE_CLI_LOG_FILEPATH}
10+
;;
11+
false-false)
12+
echo "$(date +'%Y-%m-%d %T')Z INFO ${@}" ${AWSECURE_CLI_LOG_TO_FILE_CMD}
13+
;;
14+
esac
15+
}
16+
17+
function awsecure_cli_log_error() {
18+
case "${AWSECURE_CLI_MUTED// /}-${AWSECURE_CLI_LOG_TO_FILE// /}" in
19+
false-true)
20+
echo "$(date +'%Y-%m-%d %T')Z ERROR ${@}" ${AWSECURE_CLI_LOG_TO_FILE_CMD} | tee -a ${AWSECURE_CLI_LOG_FILEPATH}
21+
;;
22+
false-false)
23+
echo "$(date +'%Y-%m-%d %T')Z ERROR ${@}" ${AWSECURE_CLI_LOG_TO_FILE_CMD}
24+
;;
25+
esac
26+
false
27+
}

0 commit comments

Comments
 (0)