Aws-vault: Add command to print credentials as JSON for aws-cli's "credential_process" configuration

[teeberg]

I only just learnt that aws-cli has a credential_process setting that lets you specify an external program to generate credentials for you: https://docs.aws.amazon.com/cli/latest/topic/config-vars.html#sourcing-credentials-from-external-processes

I already started using this with aws-vault by adding this to my ~/.aws/config:

[profile myprofile]
credential_process = aws-vault exec myprofile -- /usr/local/bin/aws_vault_credential_process

where /usr/local/bin/aws_vault_credential_process is this little helper script:

#!/bin/bash
OUTPUT="$(jq -Mn \
    --arg access_key_id "${AWS_ACCESS_KEY_ID}" \
    --arg secret_access_key "${AWS_SECRET_ACCESS_KEY}" \
    --arg session_token "${AWS_SESSION_TOKEN}" \
    --arg security_token "${AWS_SECURITY_TOKEN}" \
    --arg expiration_date "$(date -v+10M -u "+%FT%TZ")" \
    '{Version: 1, AccessKeyId: $access_key_id, SecretAccessKey: $secret_access_key, SessionToken: $session_token, Expiration: $expiration_date}')"
if [ -z "$AWS_SESSION_TOKEN" ]; then
    OUTPUT="$(echo "$OUTPUT" | jq 'del(.Expiration)')"
fi
echo "$OUTPUT"

Now instead of always having to type aws-vault exec myprofile -- aws command, I can simply set AWS_PROFILE=myprofile in the environment (which I automated using direnv) and then run aws command, which saves me quite some typing :)

It would be really neat if aws-vault could generate a JSON ready for being consumed by aws-cli, so that the above helper script isn't needed. I picture something like aws-vault exec myprofile --json (just like the --server flag) so that you could specify it in your ~/.aws/config like this instead:

[profile myprofile]
credential_process = aws-vault exec myprofile --json

[frezbo]

@teeberg I don't know if this is a coincidence, I was just testing this today. :D

[mtibben]

Great idea! Seems like low-hanging fruit for anyone who want's to contribute a PR here

[williamdenton]

@lox can this be closed?

[stale[bot]]

This issue has been automatically marked as stale because it has not had recent activity. It will be closed if no further activity occurs. Thank you for your contributions.

[teeberg]

This was done in https://github.com/99designs/aws-vault/pull/300