AWS SSO login to credentials as environment variables

user_296988 0
Viewed 2728

Given that logging-in with aws login sso is successful.

Successully logged into Start URL: *****

From here I want to start my service that requires the following environment variables with AWS credentials to be set:

  • AWS_ACCESS_KEY_ID
  • AWS_SECRET_ACCESS_KEY
  • AWS_SESSION_TOKEN

How can I extract those variables into the current shell?

A workaround which I am currently using:

I found a possible workaround that works for me: I noticed that after I login and run aws sts get-caller-identity it creates files in the ~/.aws directory, from where it can be parsed with script like:

#!/usr/bin/env bash

set -e

AWS_ACCESS_KEY_ID=$(cat ~/.aws/cli/cache/*.json | jq '.Credentials.AccessKeyId' --raw-output)
AWS_SECRET_ACCESS_KEY=$(cat ~/.aws/cli/cache/*.json | jq '.Credentials.SecretAccessKey' --raw-output)
AWS_SESSION_TOKEN=$(cat ~/.aws/cli/cache/*.json | jq '.Credentials.SessionToken' --raw-output)

>&2 echo "✨ you need to eval output of this script in your current window:"
>&2 echo '    eval $('$0')'
>&2 echo ""
echo "export AWS_ACCESS_KEY_ID=${AWS_ACCESS_KEY_ID}"
echo "export AWS_SECRET_ACCESS_KEY=${AWS_SECRET_ACCESS_KEY}"
echo "export AWS_SESSION_TOKEN=${AWS_SESSION_TOKEN}"

After evaluating the output of this script with eval $(./parse-aws-cache.sh) the environment variables are set, and I can start my service consuming AWS credentials.

It works for me for today, but I have some doubts about this solution:

  • I cannot see where this behavior is documented in AWS;
  • also reading from a directory named something cache does not seem reliable;
  • I have no idea how portable it is to work on other machines with a different configuration.

Ideally, I would expect an answer which either:

  • provides another, more reliable way of sourcing those environment variables;
  • or gives a reasonable confirmation that the method of parsing those variables from the cache file is actually ok to use.
aws-sts aws-sso amazon-web-services command-line-interface environment-variables
2 Answers

The credential values can be fetched from the SDK, instead of parsing cache files.

Here is Javascript code that prints out the AWS credentials:

const { fromSSO } = require("@aws-sdk/credential-provider-sso");
const getCredentials = fromSSO({ profile: "-MY-AWS-PROFILE" });

getCredentials().then(credentials => {
  console.error('✨ you need to eval output of this script in your current window');
  console.error(`  eval $(node ${__filename})`);

  console.log(`export AWS_ACCESS_KEY_ID=${credentials.accessKeyId}`);
  console.log(`export AWS_SECRET_ACCESS_KEY=${credentials.secretAccessKey}`);
  console.log(`export AWS_SESSION_TOKEN=${credentials.sessionToken}`);
}).catch(e => {
  console.error('Error parsing credentials', e);
});

The only problem with it is that it depends on NodeJs, and SDK library needs to be installed.

user_2969880

I have 2 possible solutions here:

  1. Use something like aws-vault to expose the credentials.
  2. Modify your docker container to use the default credential chain and mount your ~./aws directory into the container.
user_21534590
Related