Skip to content

Commit 73c4849

Browse files
LozanoMatheusLozanoMatheus
committed
Adding repo information
0 parents  commit 73c4849

File tree

5 files changed

+250
-0
lines changed

5 files changed

+250
-0
lines changed

‎.awsecure-cli-user-flow.png‎

70.7 KB
Loading

‎.awsecure-cli.gif‎

69.6 KB
Loading

‎.github/ISSUE_TEMPLATE/bug_report.md‎

Lines changed: 45 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,45 @@
1+
---
2+
name: Bug report
3+
about: Create a report to help us improve
4+
title: 'BUG: '
5+
labels: 'bug'
6+
assignees: ''
7+
---
8+
9+
**NEVER EVER SHARE YOUR ACCOUNT ID (OR ALIAS), USERNAME, or AWS ACCESS KEYS**
10+
11+
**Describe the bug**
12+
<!---
13+
A clear and concise description of what the bug is.
14+
--->
15+
16+
**How to Reproduce it**
17+
<!---
18+
This is how you can reproduce it
19+
20+
1. Install on '...'
21+
2. Configure the '...'
22+
3. Run the '...'
23+
4. See error
24+
--->
25+
26+
**Expected behavior**
27+
<!---
28+
A clear and concise description of what you expected to happen.
29+
--->
30+
31+
**Additional information**
32+
<!---
33+
If possible, enable the debug mode `set -x`.
34+
Make sure to remove the sensitive date (credentials, account id, etc).
35+
--->
36+
37+
**Your setup**
38+
<!---
39+
**NEVER EVER SHARE YOUR ACCOUNT ID (OR ALIAS), USERNAME, or AWS ACCESS KEYS**
40+
41+
- OS: [e.g. macOS]
42+
- sh interpreter [e.g. zsh, bash]
43+
Go to your terminal and run `echo $0`
44+
- Other tools version [e.g. jq, aws]
45+
--->

‎.github/ISSUE_TEMPLATE/feature_request.md‎

Lines changed: 30 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,30 @@
1+
---
2+
name: Feature request
3+
about: Suggest an idea for this project
4+
title: 'FEATURE: '
5+
labels: 'feature'
6+
assignees: ''
7+
8+
---
9+
10+
**NEVER EVER SHARE YOUR ACCOUNT ID (OR ALIAS), USERNAME, or AWS ACCESS KEYS**
11+
12+
**Is your feature request related to a problem? Please describe**
13+
<!---
14+
A clear and concise description of what the problem or the new feature. Ex. I'm always frustrated when [...]
15+
--->
16+
17+
**Describe the solution you'd like**
18+
<!---
19+
A clear and concise description of what you want to happen.
20+
--->
21+
22+
**Describe alternatives you've considered**
23+
<!---
24+
A clear and concise description of any alternative solutions or features you've considered.
25+
--->
26+
27+
**Additional information**
28+
<!---
29+
Add any other context or screenshots about the feature request here.
30+
--->

‎README.md‎

Lines changed: 175 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,175 @@
1+
# AWSecure CLI
2+
3+
**Security is an important topic, so why not facilitate the adoption of good security practices?**
4+
5+
Enabling, in the client-side, the AWS Access Keys auto-rotation, based on user definition (e.g. 168 hours) and also MFA for each request made by the AWS CLI.
6+
7+
This tool also integrates with `kubectl`, so it will add one more security layer when dealing with Amazon EKS objects.
8+
9+
_Hoping these will become a native features_
10+
11+
**NEVER EVER SHARE YOUR ACCOUNT ID (OR ALIAS), USERNAME, AND ACCESS KEYS**
12+
13+
![awsecure-cli](./.awsecure-cli.gif)
14+
15+
## Video demo
16+
17+
<a href="https://www.youtube.com/watch?v=E8blMxdl0Ao" title="AWSecure CLI">
18+
<p align="center">
19+
<img width=75% src="https://img.youtube.com/vi/E8blMxdl0Ao/maxresdefault.jpg" alt="AWSecure CLI Thumbnail"/>
20+
</p>
21+
</a>
22+
23+
---
24+
25+
## Pre-requirements
26+
27+
* [bash](https://tiswww.case.edu/php/chet/bash/bashtop.html) or [zsh](https://zsh.sourceforge.io/)
28+
* [jq](https://stedolan.github.io/jq/)
29+
* [AWS CLI](https://aws.amazon.com/cli/)
30+
* [realpath](https://github.com/coreutils/coreutils)
31+
32+
## AWS Access Keys auto-rotation
33+
34+
The AWSecure CLI can autorotate the AWS Access Keys based on the profile that the user is currently using or via cronjob.
35+
36+
For example, if you configured to only use in the user request and there are multiple profiles configured in your `~/.aws/credentials` and `~/.aws/config`, the AWSecure CLI won't autorotate the other AWS Access Keys.
37+
38+
![awsecure-cli-user-flow](./.awsecure-cli-user-flow.png)
39+
40+
### How it works - user request
41+
42+
The AWS Access Keys auto-rotation works transparently for the users, when the user executes an AWS command (e.g. `aws lambda list-functions`), it will check if needs to rotate the AWS Access Keys for the current AWS Profile. Once the AWS Access Keys auto-rotation steps are done, it will run the command requested by the user (e.g. `aws lambda list-functions`).
43+
44+
### How it works - cronjob
45+
46+
This allows users to add the AWS Access Keys auto-rotation as a cronjob (e.g. on crontab), so they can disable it when running any AWS command. It's also possible to add multiple entries, one per AWS profile.
47+
48+
For example:
49+
Configure the `~/.awsecure-cli` to never run the AWS Access Keys auto-rotation.
50+
51+
```bash
52+
AWSECURE_CLI_AWS_BIN_FILEPATH=~/.asdf/shims/aws
53+
AWSECURE_CLI_MUTED="true"
54+
AWSECURE_CLI_AUTOROTATE_AWS_ACCESS_KEYS="false"
55+
AWSECURE_CLI_LOG_TO_FILE="false"
56+
```
57+
58+
And configure the crontab to try the AWS Access Keys auto-rotation every 4 hours. This will write the logs to `/tmp/awsecure-cli.log.<Ymd>` (e.g. `/tmp/awsecure-cli.log.20220215`).
59+
60+
```bash
61+
$ crontab -e
62+
63+
PATH=/usr/local/bin:...
64+
65+
0 */4 * * * AWSECURE_CLI_LOG_TO_FILE="true" AWSECURE_CLI_AUTOROTATE_ONLY="true" AWSECURE_CLI_AUTOROTATE_AWS_ACCESS_KEYS="true" AWS_PROFILE=my_profile001 aws
66+
0 */4 * * * AWSECURE_CLI_LOG_TO_FILE="true" AWSECURE_CLI_AUTOROTATE_ONLY="true" AWSECURE_CLI_AUTOROTATE_AWS_ACCESS_KEYS="true" AWS_PROFILE=my_profile002 aws
67+
0 */4 * * * AWSECURE_CLI_LOG_TO_FILE="true" AWSECURE_CLI_AUTOROTATE_ONLY="true" AWSECURE_CLI_AUTOROTATE_AWS_ACCESS_KEYS="true" AWS_PROFILE=my_profile003 aws
68+
```
69+
70+
> Make sure you have the environment variable PATH configure and pointing to AWSecure CLI.
71+
72+
## Instalation
73+
74+
There are two ways you can install the wrapper. You can create a symbolic link to `/usr/local/bin` (or another place of your choice) or by setting the `awsecure-cli/bin/<INTERPRETER>`.
75+
76+
### Bash
77+
78+
```bash
79+
git clone git@github.com:LozanoMatheus/awsecure-cli.git
80+
ln -s $(realpath awsecure-cli/bin/bash/aws) /usr/local/bin/aws
81+
echo 'PATH=/usr/local/bin:${PATH}' >> ~/.bash_profile
82+
```
83+
84+
### Zsh
85+
86+
```bash
87+
git clone git@github.com:LozanoMatheus/awsecure-cli.git
88+
ln -s $(realpath awsecure-cli/bin/zsh/aws) /usr/local/bin/aws
89+
echo 'PATH=/usr/local/bin:${PATH}' >> ~/.zshrc
90+
```
91+
92+
## Configuring
93+
94+
These are the configurations that you can define in your `~/.awsecure-cli`.
95+
96+
| PARAMETER | DEFAULT | ACCEPTED<br> VALUES | COMMENT |
97+
|:---------------------------------------:|:-----------:|:----------------------------:|:-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------:|
98+
| AWSECURE_CLI_AWS_BIN_FILEPATH <b>*<b> | not defined | absolute path | The path where your AWS CLI is installed (not the AWSecure CLI). Not setting this parameter will cause the AWSecure CLI to terminate and no command will be executed |
99+
| AWSECURE_CLI_MUTED | false | true<br>false | In case you need/want to see some logs. Setting this parameter to `no` will make the `kubectl` to fail with the error below.<br>Unable to connect to the server: getting credentials: decoding stdout: yaml: line 2: mapping values are not allowed in this context |
100+
| AWSECURE_CLI_LOG_TO_FILE | false | true<br>false | This will send the logs to a file `/tmp/awsecure-cli.log.<Ymd>` (e.g. `/tmp/awsecure-cli.log.20220215`) |
101+
| AWSECURE_CLI_AUTOROTATE_AWS_ACCESS_KEYS | true | true<br>false | Enable the AWS Access Keys autorotation |
102+
| AWSECURE_CLI_AUTOROTATE_PERIOD | 168 | 1 to ... | This value is based on hours and once your AWS Access Keys are older than this, it will autorotate (168 hours == 7 days) |
103+
| AWSECURE_CLI_AUTOROTATE_CHECK | daily | daily<br>on-reboot<br>always | This is when the autorotate will be executed.<br>If you're using in the user request, this will only be triggered if you run the AWS CLI |
104+
| AWSECURE_CLI_AUTOROTATE_ONLY | not defined | true<br>false | This trigger the only the AWS Access Keys auto-rotation, any AWS command (e.g. `aws lambda list-functions`) will be ignored |
105+
106+
> \* mandatory parameter
107+
108+
### Example
109+
110+
You can configure via `~/.awsecure-cli`.
111+
112+
```bash
113+
AWSECURE_CLI_AWS_BIN_FILEPATH=~/.asdf/shims/aws
114+
AWSECURE_CLI_MUTED="false"
115+
AWSECURE_CLI_AUTOROTATE_AWS_ACCESS_KEYS="true"
116+
AWSECURE_CLI_AUTOROTATE_PERIOD="24"
117+
AWSECURE_CLI_AUTOROTATE_CHECK="always"
118+
AWSECURE_CLI_AUTOROTATE_ONLY="true"
119+
AWSECURE_CLI_LOG_TO_FILE="true"
120+
```
121+
122+
Or export the environment variables, like:
123+
124+
```bash
125+
export AWSECURE_CLI_AWS_BIN_FILEPATH=~/.asdf/shims/aws
126+
export AWSECURE_CLI_MUTED="false"
127+
export AWSECURE_CLI_AUTOROTATE_AWS_ACCESS_KEYS="true"
128+
export AWSECURE_CLI_AUTOROTATE_PERIOD="24"
129+
export AWSECURE_CLI_AUTOROTATE_CHECK="always"
130+
export AWSECURE_CLI_AUTOROTATE_ONLY="true"
131+
export AWSECURE_CLI_LOG_TO_FILE="true"
132+
```
133+
134+
> The exported environment variable has high priority over the file `~/.awsecure-cli`.
135+
136+
## Integrating with kubectl
137+
138+
The integration with `kubectl` will be done thanks to the integration between AWS STS and Kubernetes.
139+
140+
The command below will add or update your `~/.kube/config` and you can see how this works by searching for `command: aws` kube config file.
141+
142+
```bash
143+
aws eks update-kubeconfig --name <EKS_CLUSTER_NAME> --role-arn <ROLE_ARN> --alias <ALIAS_ON_KUBE_CONFIG>
144+
```
145+
146+
Make sure you have, at least, the `AWS_PROFILE` and `AWSECURE_CLI_MUTED` defined in your `~/.kube/config`.
147+
148+
```yaml
149+
- name: arn:aws:eks:<REGION>:<ACCOUNT_ID>:cluster/<CLUSTER_NAME>
150+
user:
151+
exec:
152+
apiVersion: <API_VERSION>
153+
args:
154+
- --region
155+
- <REGION>
156+
- eks
157+
- get-token
158+
- --cluster-name
159+
- <CLUSTER_NAME>
160+
- --role
161+
- arn:aws:iam::<ACCOUNT_ID>:role/<ROLE_NAME>
162+
command: aws
163+
env:
164+
- name: AWS_PROFILE
165+
value: <AWS_PROFILE>
166+
- name: AWSECURE_CLI_AUTOROTATE_CHECK
167+
value: on-reboot
168+
- name: AWSECURE_CLI_MUTED
169+
value: "true"
170+
```
171+
172+
For more information, please check the AWS official documentation.
173+
174+
* [Create a kubeconfig for Amazon EKS](https://docs.aws.amazon.com/eks/latest/userguide/create-kubeconfig.html)
175+
* [AWS CLI - aws eks update-kubeconfig](https://docs.aws.amazon.com/cli/latest/reference/eks/update-kubeconfig.html)

0 commit comments

Comments
 (0)