Secure your code as it's written. Use Snyk Code to scan source code in minutes - no build needed - and fix issues immediately.
def get_assume_role_credentials(config: dict, arguments: argparse.Namespace, profiles: dict, target_profile: dict, role_duration: int):
region = profile_lib.get_region(profiles, arguments, config)
external_id = profile_lib.get_external_id(arguments, target_profile)
source_profile = profile_lib.get_source_profile(profiles, arguments.target_profile_name)
source_credentials = profile_lib.profile_to_credentials(source_profile)
role_session = aws_lib.assume_role(
source_credentials,
target_profile.get('role_arn'),
arguments.session_name or arguments.target_profile_name,
region=region,
external_id=external_id,
role_duration=role_duration,
)
return role_session
def get_credentials_no_mfa(config: dict, arguments: argparse.Namespace, profiles: dict, target_profile: dict):
region = profile_lib.get_region(profiles, arguments, config)
return_session = profile_lib.profile_to_credentials(target_profile)
return_session['Region'] = region
return return_session
def assume_role_from_cli(config: dict, arguments: dict, profiles: dict):
region = profile_lib.get_region(profiles, arguments, config, ignore_config=True, ignore_default=True)
logger.info('Using role_arn from the CLI')
role_duration = arguments.role_duration or int(config.get('role-duration', 0))
session_name = arguments.session_name or 'awsume-cli-role'
logger.debug('Session name: {}'.format(session_name))
if not arguments.source_profile:
logger.debug('Using current credentials to assume role')
role_session = aws_lib.assume_role({}, arguments.role_arn, session_name, region=region, external_id=arguments.external_id, role_duration=role_duration)
else:
logger.debug('Using the source_profile from the cli to call assume_role')
source_profile = profiles.get(arguments.source_profile)
if not source_profile:
raise exceptions.ProfileNotFoundError(profile_name=arguments.source_profile)
source_credentials = profile_lib.profile_to_credentials(source_profile)
mfa_serial = source_profile.get('mfa_serial')
if role_duration:
logger.debug('Using custom role duration')
if mfa_serial:
logger.debug('Requires MFA')
logger.debug('Using custom role duration for role that needs mfa_serial, skipping get-session-token call')
source_session = source_credentials
role_session = aws_lib.assume_role(
source_session,
arguments.role_arn,
session_name,
region=region,
external_id=arguments.external_id,
role_duration=role_duration,
mfa_serial=mfa_serial,
mfa_token=arguments.mfa_token,
def get_assume_role_credentials_mfa_required(config: dict, arguments: argparse.Namespace, profiles: dict, target_profile: dict, role_duration: int):
region = profile_lib.get_region(profiles, arguments, config)
mfa_serial = profile_lib.get_mfa_serial(profiles, arguments.target_profile_name)
external_id = profile_lib.get_external_id(arguments, target_profile)
source_profile = profile_lib.get_source_profile(profiles, arguments.target_profile_name)
if source_profile:
logger.debug('Calling get_session_token to assume role with')
source_credentials = profile_lib.profile_to_credentials(source_profile)
source_session = aws_lib.get_session_token(
source_credentials,
region=region,
mfa_serial=mfa_serial,
mfa_token=arguments.mfa_token,
ignore_cache=arguments.force_refresh,
duration_seconds=config.get('debug', {}).get('session_token_duration'),
)
elif target_profile.get('credential_source') == 'Environment':
logger.debug('Using current environment to assume role')
source_session = {}
if arguments.auto_refresh and os.environ.get('AWS_PROFILE', '').startswith('autoawsume-'):
os.environ.pop('AWS_PROFILE')
os.environ.pop('AWS_DEFAULT_PROFILE')
def get_assume_role_credentials_mfa_required_large_custom_duration(config: dict, arguments: argparse.Namespace, profiles: dict, target_profile: dict, role_duration: int):
if arguments.auto_refresh and role_duration > 3600:
raise exceptions.ValidationException('Cannot use autoawsume with custom role duration of more than 1 hour')
logger.debug('Skipping the get_session_token call, temp creds cannot be used for custom role duration')
region = profile_lib.get_region(profiles, arguments, config)
mfa_serial = profile_lib.get_mfa_serial(profiles, arguments.target_profile_name)
external_id = profile_lib.get_external_id(arguments, target_profile)
source_profile = profile_lib.get_source_profile(profiles, arguments.target_profile_name)
source_session = profile_lib.profile_to_credentials(source_profile)
role_session = aws_lib.assume_role(
source_session,
target_profile.get('role_arn'),
arguments.session_name or arguments.target_profile_name,
region=region,
external_id=external_id,
role_duration=role_duration,
mfa_serial=mfa_serial,
mfa_token=arguments.mfa_token,
)
return role_session