common-fate / granted

The easiest way to access your cloud.
https://granted.dev
MIT License
956 stars 90 forks source link

Support populating required variable with fixed value #606

Open jamespope101 opened 4 months ago

jamespope101 commented 4 months ago

We are using a registry with configs and template values in such a way that there are global profiles that can be used by the company, and then team-specific profiles added on per team. We have a layout like below.

.
├── granted-configs
│   ├── config-company
│   ├── config-teamA
│   ├── granted-company.yml
│   ├── granted-teamA.yml

config-company

[profile production]
credential_process = /usr/local/bin/go-aws-sso assume -a 000000000000 -n {{ .Required.TeamRole }}
region             = eu-west-1

config-teamA

[profile teamA-app1-production]
source_profile = production
role_arn       = arn:aws:iam::000000000000:role/teamA-app1

A developer can then choose to add a registry for just the company-wide roles, or to register for company+team roles, by using one of these yml files:

granted-company.yml

awsConfig:
    - ./config-company
templateValues:
  - TeamRole:
      - isRequired: true
      - prompt: "Enter your team's SSO role (e.g. TeamA, TeamB, ...)"

granted-teamA.yml

awsConfig:
  - ./config-company
  - ./config-teamA
templateValues:
  - TeamRole:
      - isRequired: true
      - prompt: "Confirm your team's SSO role by typing: TeamA"

Problem When a member of TeamA wants to register for global+TeamA roles, by using granted-teamA.yml, in order to populate the .Required variable required by granted-compnany.yml, we also have to make the variable required in granted-teamA.yml. This leads to a prompt, even when we know what we want the value to be.

Feature Request Allow an isRequired templateValue to be populated with a fixed value and bypass the prompt. With the above setup the granted-teamA.yml would look like:

awsConfig:
  - ./granted-company
  - ./granted-teamA
templateValues:
  - TeamRole:
      - isRequired: true
      - value: "TeamA"