AWS cli tools

update-api-keys.sh

#! /bin/bash -xe
# This script requires `jq` and optionally `awsume`

awsume --session-name ssummers-update-api-keys  # or whatever method to assume an mfa session

AWS_EXPIRING_ACCESS_KEY=$(aws configure get aws_access_key_id)
AWS_USER=$(aws sts get-caller-identity --query Arn --output text | awk -F/ '/:user/ {print $2}')

if [[ $(aws iam list-access-keys --user-name ${AWS_USER} --query '*[]|length(@)') -ne 1 ]]
then
    echo "There is already a second API key set up; too dangerous to continue."
    exit 1
fi

export AWS_NEW_CREDENTIALS=$(aws iam create-access-key --user-name ${AWS_USER} --query AccessKey)

aws configure set aws_access_key_id $(echo $AWS_NEW_CREDENTIALS | jq -r .AccessKeyId)
aws configure set aws_secret_access_key $(echo $AWS_NEW_CREDENTIALS | jq -r .SecretAccessKey)

aws iam update-access-key --access-key-id ${AWS_EXPIRING_ACCESS_KEY} --status Inactive --user-name ${AWS_USER}
aws iam delete-access-key --access-key-id ${AWS_EXPIRING_ACCESS_KEY} --user-name ${AWS_USER}