AWS CLI MFA

aws-mfa.sh

#!/bin/bash

CACHE_FILE=~/.aws/aws-mfa-cache
OTHER="other"

function input_account () {
  read -p "Account ID? " AWS_ACCOUNT_ID
  read -p "Username? " AWS_USERNAME
  read -p "Profile? " AWS_PROFILE
}

function save_account () {
  echo "$AWS_ACCOUNT_ID:$AWS_USERNAME:$AWS_PROFILE" >> $CACHE_FILE
  echo "Cached: $AWS_ACCOUNT_ID:$AWS_USERNAME:$AWS_PROFILE"
}

ACCOUNT=$OTHER

if [ -e $CACHE_FILE ]; then
  # Cache file exists
  CACHE_DATA=`cat $CACHE_FILE`
  PS3='Choose account: '
  select ACCOUNT in ${CACHE_DATA[@]} $OTHER
  do
    if [ $ACCOUNT = $OTHER ]; then
      # User input
      input_account
    else
      # Cached account
      OLDIFS=$IFS
      IFS=: ARR=(${ACCOUNT})
      AWS_ACCOUNT_ID=${ARR[0]}
      AWS_USERNAME=${ARR[1]}
      AWS_PROFILE=${ARR[2]}
      IFS=$OLDIFS
    fi
    break
  done
else
  # No cache file
  input_account
fi

ARR=($AWS_ACCOUNT_ID $AWS_USERNAME $AWS_PROFILE)
if [ ${#ARR[@]} -ne 3 ]; then
  echo "Canceled"
  exit 0
fi

AWS_CRED_FILE=~/.aws/credentials

if [ ! $(grep -E "\[$AWS_PROFILE\]" $AWS_CRED_FILE) ]; then
  echo "Profile '$AWS_PROFILE' not found in $AWS_CRED_FILE. The following profiles are available."
  grep -E "\[.+\]" $AWS_CRED_FILE | grep -ve "-mfa" | sed -r 's/^\[(.+)\]$/- \1/'
  exit 1
fi

read -p "Code? " CODE

SESSION_JSON=$(aws --profile $AWS_PROFILE sts get-session-token --serial-number arn:aws:iam::$AWS_ACCOUNT_ID:mfa/$AWS_USERNAME --token-code $CODE --output json)
if [ $? -ne 0 ]; then
  exit 1
fi

MFA_ACCESS_KEY=$(echo $SESSION_JSON | jq -r '.Credentials.AccessKeyId')
MFA_SECRET_ACCESS_KEY=$(echo $SESSION_JSON | jq -r '.Credentials.SecretAccessKey')
MFA_SESSION_TOKEN=$(echo $SESSION_JSON | jq -r '.Credentials.SessionToken')
MFA_EXPIRATION=$(echo $SESSION_JSON | jq -r '.Credentials.Expiration')

if [ $? != 0 ]; then
  echo "Failed to parse response json"
  echo $SESSION_JSON
  exit 1
fi

MFA_PROFILE_NAME=$AWS_PROFILE-mfa

aws --profile $MFA_PROFILE_NAME configure set aws_access_key_id $MFA_ACCESS_KEY
aws --profile $MFA_PROFILE_NAME configure set aws_secret_access_key $MFA_SECRET_ACCESS_KEY
aws --profile $MFA_PROFILE_NAME configure set aws_session_token $MFA_SESSION_TOKEN

echo "MFA profile: $MFA_PROFILE_NAME (expiration: $MFA_EXPIRATION)"

if [ $ACCOUNT = $OTHER ]; then
  save_account
fi