AWS environment setup with MFA devices

aws-mfa

#!/usr/bin/env bash
set -e

SERIAL_NUMBER=$1
TOKEN_CODE=$2

if [ -z "${SERIAL_NUMBER}" ] || [ -z "${TOKEN_CODE}" ]; then
  # Clear when called with eval
  >&2 echo "# Clearing credentials"
  echo "unset AWS_ACCESS_KEY_ID"
  echo "unset AWS_SECRET_ACCESS_KEY"
  echo "unset AWS_SESSION_TOKEN"
  echo "unset AWS_PROFILE"
  >&2 echo "# To request credentials: eval \$($0 MFA-SERIAL-NUMBER TOKEN-CODE)"
  exit 2
fi

# Clear within session to retrieve new tokens
unset AWS_ACCESS_KEY_ID
unset AWS_SECRET_ACCESS_KEY
unset AWS_SESSION_TOKEN

RESULT=$(aws sts get-session-token --serial-number ${SERIAL_NUMBER} --token-code ${TOKEN_CODE})

EXPIRATION=$(echo ${RESULT} | jq '.Credentials.Expiration')
ACCESS_KEY_ID=$(echo ${RESULT} | jq '.Credentials.AccessKeyId')
SECRET_ACCESS_KEY=$(echo ${RESULT} | jq '.Credentials.SecretAccessKey')
SESSION_TOKEN=$(echo ${RESULT} | jq '.Credentials.SessionToken')

>&2 echo "# Got credentials, valid until ${EXPIRATION}"
echo "export AWS_PROFILE=${AWS_PROFILE}"
echo "export AWS_ACCESS_KEY_ID=${ACCESS_KEY_ID}"
echo "export AWS_SECRET_ACCESS_KEY=${SECRET_ACCESS_KEY}"
echo "export AWS_SESSION_TOKEN=${SESSION_TOKEN}"

example.svg