|
| 1 | +--- |
1 | 2 | name: aws/assume-role |
2 | | -version: 2.0.6 |
| 3 | +version: '2.1' |
3 | 4 | description: Assume an AWS role |
4 | 5 | source_code_url: https://github.com/rwx-cloud/packages/tree/main/aws/assume-role |
5 | 6 | issue_tracker_url: https://github.com/rwx-cloud/packages/issues |
6 | | - |
7 | 7 | parameters: |
8 | 8 | region: |
9 | | - description: "The AWS region (e.g. us-east-2)." |
| 9 | + description: The AWS region (e.g. us-east-2). |
10 | 10 | required: true |
11 | 11 | role-to-assume: |
12 | | - description: "The ARN of the AWS role to be assumed (e.g. arn:aws:iam::your-account-id:role/your-role)." |
| 12 | + description: The ARN of the AWS role to be assumed (e.g. arn:aws:iam::your-account-id:role/your-role). |
13 | 13 | required: true |
14 | 14 | role-duration-seconds: |
15 | | - description: "The role duration in seconds." |
| 15 | + description: The role duration in seconds. |
16 | 16 | default: 900 |
17 | 17 | role-session-name: |
18 | | - description: "The name of the session." |
| 18 | + description: The name of the session. |
19 | 19 | required: false |
20 | 20 | profile-name: |
21 | | - description: "The profile under which the credentials will be configured." |
22 | | - default: "default" |
| 21 | + description: The profile under which the credentials will be configured. |
| 22 | + default: default |
23 | 23 | oidc-token-env-var: |
24 | | - description: "The environment variable that contains the OIDC token." |
25 | | - default: "AWS_OIDC_TOKEN" |
| 24 | + description: The environment variable that contains the OIDC token. |
| 25 | + default: AWS_OIDC_TOKEN |
26 | 26 | role-chaining: |
27 | | - description: "Enable role chaining." |
| 27 | + description: Enable role chaining. |
28 | 28 | default: false |
29 | 29 | source-profile-name: |
30 | | - description: "The profile used to assume the chained role (only used with role-chaining is enabled)." |
31 | | - default: "default" |
32 | | - |
| 30 | + description: The profile used to assume the chained role (only used with role-chaining |
| 31 | + is enabled). |
| 32 | + default: default |
33 | 33 | tasks: |
34 | | - - key: produce-assume-role-hooks |
35 | | - run: | |
36 | | - set -ueo pipefail |
| 34 | +- key: produce-assume-role-hooks |
| 35 | + run: | |
| 36 | + set -ueo pipefail |
37 | 37 |
|
38 | | - if [[ "${{ params.role-chaining}}" == "false" ]]; then |
39 | | - BEFORE_HOOK_TEMPLATE="$RWX_PACKAGES_PATH/assume-role.template.txt" |
40 | | - BEFORE_HOOK="$RWX_HOOKS_BEFORE_TASK/aws-assume-role--assume-${{ params.profile-name }}.sh" |
41 | | - AFTER_HOOK="$RWX_HOOKS_AFTER_TASK/aws-assume-role--assume-${{ params.profile-name }}.sh" |
| 38 | + if [[ "${{ params.role-chaining}}" == "false" ]]; then |
| 39 | + BEFORE_HOOK_TEMPLATE="$RWX_PACKAGES_PATH/assume-role.template.txt" |
| 40 | + BEFORE_HOOK="$RWX_HOOKS_BEFORE_TASK/aws-assume-role--assume-${{ params.profile-name }}.sh" |
| 41 | + AFTER_HOOK="$RWX_HOOKS_AFTER_TASK/aws-assume-role--assume-${{ params.profile-name }}.sh" |
42 | 42 |
|
43 | | - awk \ |
44 | | - -v REGION="${{ params.region }}" \ |
45 | | - -v ROLE_TO_ASSUME="${{ params.role-to-assume }}" \ |
46 | | - -v ROLE_DURATION_SECONDS="${{ params.role-duration-seconds }}" \ |
47 | | - -v ROLE_SESSION_NAME="${{ params.role-session-name }}" \ |
48 | | - -v PROFILE_NAME="${{ params.profile-name }}" \ |
49 | | - -v OIDC_TOKEN_ENV_VAR="${{ params.oidc-token-env-var }}" \ |
50 | | - '{ |
51 | | - gsub("%{{REGION}}", REGION); |
52 | | - gsub("%{{ROLE_TO_ASSUME}}", ROLE_TO_ASSUME); |
53 | | - gsub("%{{ROLE_DURATION_SECONDS}}", ROLE_DURATION_SECONDS); |
54 | | - gsub("%{{ROLE_SESSION_NAME}}", ROLE_SESSION_NAME); |
55 | | - gsub("%{{PROFILE_NAME}}", PROFILE_NAME); |
56 | | - gsub("%{{OIDC_TOKEN_ENV_VAR}}", OIDC_TOKEN_ENV_VAR); |
57 | | - print |
58 | | - }' "$BEFORE_HOOK_TEMPLATE" > $BEFORE_HOOK |
| 43 | + awk \ |
| 44 | + -v REGION="${{ params.region }}" \ |
| 45 | + -v ROLE_TO_ASSUME="${{ params.role-to-assume }}" \ |
| 46 | + -v ROLE_DURATION_SECONDS="${{ params.role-duration-seconds }}" \ |
| 47 | + -v ROLE_SESSION_NAME="${{ params.role-session-name }}" \ |
| 48 | + -v PROFILE_NAME="${{ params.profile-name }}" \ |
| 49 | + -v OIDC_TOKEN_ENV_VAR="${{ params.oidc-token-env-var }}" \ |
| 50 | + '{ |
| 51 | + gsub("%{{REGION}}", REGION); |
| 52 | + gsub("%{{ROLE_TO_ASSUME}}", ROLE_TO_ASSUME); |
| 53 | + gsub("%{{ROLE_DURATION_SECONDS}}", ROLE_DURATION_SECONDS); |
| 54 | + gsub("%{{ROLE_SESSION_NAME}}", ROLE_SESSION_NAME); |
| 55 | + gsub("%{{PROFILE_NAME}}", PROFILE_NAME); |
| 56 | + gsub("%{{OIDC_TOKEN_ENV_VAR}}", OIDC_TOKEN_ENV_VAR); |
| 57 | + print |
| 58 | + }' "$BEFORE_HOOK_TEMPLATE" > $BEFORE_HOOK |
59 | 59 |
|
60 | | - else |
61 | | - BEFORE_HOOK_TEMPLATE="$RWX_PACKAGES_PATH/chain-role.template.txt" |
62 | | - ROLE_TO_ASSUME_HASH=$(echo -n "${{ params.role-to-assume }}" | sha1sum | awk '{print $1}') |
63 | | - BEFORE_HOOK="$RWX_HOOKS_BEFORE_TASK/aws-assume-role--chain-${{ params.profile-name }}--$ROLE_TO_ASSUME_HASH.sh" |
64 | | - AFTER_HOOK="$RWX_HOOKS_AFTER_TASK/aws-assume-role--chain-${{ params.profile-name }}--$ROLE_TO_ASSUME_HASH.sh" |
| 60 | + else |
| 61 | + BEFORE_HOOK_TEMPLATE="$RWX_PACKAGES_PATH/chain-role.template.txt" |
| 62 | + ROLE_TO_ASSUME_HASH=$(echo -n "${{ params.role-to-assume }}" | sha1sum | awk '{print $1}') |
| 63 | + BEFORE_HOOK="$RWX_HOOKS_BEFORE_TASK/aws-assume-role--chain-${{ params.profile-name }}--$ROLE_TO_ASSUME_HASH.sh" |
| 64 | + AFTER_HOOK="$RWX_HOOKS_AFTER_TASK/aws-assume-role--chain-${{ params.profile-name }}--$ROLE_TO_ASSUME_HASH.sh" |
65 | 65 |
|
66 | | - awk \ |
67 | | - -v REGION="${{ params.region }}" \ |
68 | | - -v ROLE_TO_ASSUME="${{ params.role-to-assume }}" \ |
69 | | - -v ROLE_DURATION_SECONDS="${{ params.role-duration-seconds }}" \ |
70 | | - -v ROLE_SESSION_NAME="${{ params.role-session-name }}" \ |
71 | | - -v PROFILE_NAME="${{ params.profile-name }}" \ |
72 | | - -v SOURCE_PROFILE_NAME="${{ params.source-profile-name }}" \ |
73 | | - '{ |
74 | | - gsub("%{{REGION}}", REGION); |
75 | | - gsub("%{{ROLE_TO_ASSUME}}", ROLE_TO_ASSUME); |
76 | | - gsub("%{{ROLE_DURATION_SECONDS}}", ROLE_DURATION_SECONDS); |
77 | | - gsub("%{{ROLE_SESSION_NAME}}", ROLE_SESSION_NAME); |
78 | | - gsub("%{{PROFILE_NAME}}", PROFILE_NAME); |
79 | | - gsub("%{{SOURCE_PROFILE_NAME}}", SOURCE_PROFILE_NAME); |
80 | | - print |
81 | | - }' "$BEFORE_HOOK_TEMPLATE" > $BEFORE_HOOK |
82 | | - fi |
| 66 | + awk \ |
| 67 | + -v REGION="${{ params.region }}" \ |
| 68 | + -v ROLE_TO_ASSUME="${{ params.role-to-assume }}" \ |
| 69 | + -v ROLE_DURATION_SECONDS="${{ params.role-duration-seconds }}" \ |
| 70 | + -v ROLE_SESSION_NAME="${{ params.role-session-name }}" \ |
| 71 | + -v PROFILE_NAME="${{ params.profile-name }}" \ |
| 72 | + -v SOURCE_PROFILE_NAME="${{ params.source-profile-name }}" \ |
| 73 | + '{ |
| 74 | + gsub("%{{REGION}}", REGION); |
| 75 | + gsub("%{{ROLE_TO_ASSUME}}", ROLE_TO_ASSUME); |
| 76 | + gsub("%{{ROLE_DURATION_SECONDS}}", ROLE_DURATION_SECONDS); |
| 77 | + gsub("%{{ROLE_SESSION_NAME}}", ROLE_SESSION_NAME); |
| 78 | + gsub("%{{PROFILE_NAME}}", PROFILE_NAME); |
| 79 | + gsub("%{{SOURCE_PROFILE_NAME}}", SOURCE_PROFILE_NAME); |
| 80 | + print |
| 81 | + }' "$BEFORE_HOOK_TEMPLATE" > $BEFORE_HOOK |
| 82 | + fi |
83 | 83 |
|
84 | | - bash -n $BEFORE_HOOK || { echo "Generated before hook script has syntax errors."; exit 1; } |
| 84 | + bash -n $BEFORE_HOOK || { echo "Generated before hook script has syntax errors."; exit 1; } |
85 | 85 |
|
86 | | - cat <<'EOF' > $AFTER_HOOK |
87 | | - set -ueo pipefail |
88 | | - AWS_SKIP_AUTH="${AWS_SKIP_AUTH:-}" |
89 | | - if [ -n "$AWS_SKIP_AUTH" ]; then |
90 | | - echo "AWS_SKIP_AUTH is set, the aws/assume-role hook has been skipped." |
91 | | - exit 0 |
92 | | - fi |
93 | | - echo 'Removing aws credentials' |
94 | | - if [ -f ~/.aws/credentials ]; then |
95 | | - rm ~/.aws/credentials |
96 | | - fi |
97 | | - EOF |
| 86 | + cat <<'EOF' > $AFTER_HOOK |
| 87 | + set -ueo pipefail |
| 88 | + AWS_SKIP_AUTH="${AWS_SKIP_AUTH:-}" |
| 89 | + if [ -n "$AWS_SKIP_AUTH" ]; then |
| 90 | + echo "AWS_SKIP_AUTH is set, the aws/assume-role hook has been skipped." |
| 91 | + exit 0 |
| 92 | + fi |
| 93 | + echo 'Removing aws credentials' |
| 94 | + if [ -f ~/.aws/credentials ]; then |
| 95 | + rm ~/.aws/credentials |
| 96 | + fi |
| 97 | + EOF |
98 | 98 |
|
99 | | - chmod +x $BEFORE_HOOK |
100 | | - chmod +x $AFTER_HOOK |
| 99 | + chmod +x $BEFORE_HOOK |
| 100 | + chmod +x $AFTER_HOOK |
0 commit comments