awsssod: AWS Accesskeys Management Utility

awsssod is a command-line utility designed to manage AWS credentials profiles. It extends the CloudConnector(D) browser extension, developed by DefenseK, by securely handling the generation of AWS access keys. This ensures secure management of credentials for organizations using AWS SSO with external identity providers (IdPs) like Azure AD or Okta.

Purpose

If your organization uses multiple AWS accounts and has configured AWS SSO for centralized authentication, while integrating an external identity provider (IdP), such as Azure AD or Okta, AWS does not directly provide support for generating access keys for the authenticated user. This is where CloudConnector(D) comes in, securely addressing this limitation by generating tokens, which are then used with the awsssod npm package to configure and manage AWS profiles securely.

How Does It Work?

To get started, install the CloudConnector(D) extension from the Chrome Web Store. After logging into your AWS account via SSO, open the extension and click the "Generate Token" button. This will generate a secure token that you can copy and use with the awsssod npm package to configure your AWS profiles securely.

Pre-requisites

Before using awsssod, ensure you have the following installed and configured:

• CloudConnector(D) browser extension.

• AWS CodeCommit integration (if required). You can install this pre-requisite with the following command:

  pip install git-remote-codecommit

  This is necessary for interacting with AWS CodeCommit repositories, if applicable.

Installation

To install the awsssod package, use the following command:

npm install awsssod

To install the package globally, use:

npm install -g awsssod

Usage

Commands

Use the token provided by the CloudConnector(D) browser extension in the following commands to handle AWS profiles:

1. Configure a new profile

   This command helps you configure a new AWS profile by entering necessary details (username, profile name, region, and output format).

   npx awsssod configure

2. List all available profiles

   Lists all the profiles stored in your AWS credentials file.

   npx awsssod ls

3. Update an existing profile

   Updates an existing profile with new configuration details.

   npx awsssod update <profile_name>

4. Delete a profile

   Deletes a profile from your AWS credentials file.

   npx awsssod delete <profile_name>

5. Fetch a profile

   Retrieves the details of a specific profile from your AWS credentials file.

   npx awsssod fetch <profile_name>

6. Reset Credentials

   Resets the entire AWS credentials file.

   npx awsssod reset

7. Help

   Lists all available commands and their descriptions.

   npx awsssod --help

Configuration Process

When configuring or updating a profile, the following prompts will appear:

• Username: Enter your AD email.
• Profile Name: Enter a name for the AWS profile (e.g., my_aws_profile).
• Region: Specify the AWS region (default: us-east-1).
• Output Format: Choose the output format (default: json).
• Token: Paste the encrypted token generated by the CloudConnector(D) application.

Example Workflow

1. Configure a new profile:

   npx awsssod configure

   After completing the prompts, your profile will be added to the AWS credentials file.

2. List available profiles:

   npx awsssod ls

3. Update an existing profile:

   npx awsssod update my_aws_profile

4. Delete a profile:

   npx awsssod delete my_aws_profile

5. Fetch a profile:

   npx awsssod fetch my_aws_profile

Using AWS CLI with Configured Profiles

After configuring your AWS profile with awsssod, you can use it to run AWS CLI commands, just as you would with manually configured profiles.

For example, to list all buckets in your S3 service using the configured profile:

aws s3 ls --profile <profile_name>

Where <profile_name> is the name you gave to the profile during configuration (e.g., my_aws_profile).

Similarly, you can use any AWS CLI command with the --profile flag to specify which profile to use. Some examples include:

• List EC2 instances:

  aws ec2 describe-instances --profile <profile_name>

• Check IAM users:

  aws iam list-users --profile <profile_name>

This allows you to easily switch between AWS accounts and environments using the profiles you've configured securely through awsssod.

Additional Resources

Subscribe us @DefenseK for more updates

License

This project is licensed under the ISC License.