search

rkoval / alfred-aws-console-services-workflow

A powerful workflow for quickly opening up AWS Console Services in your browser or searching for entities within them.
MIT License
312 stars 54 forks source link

support multi-factor authentication for accounts that enforce it on API access #45

Open rkoval opened 2 years ago

rkoval commented 2 years ago

details: https://aws.amazon.com/premiumsupport/knowledge-center/authenticate-mfa-cli/

seems like this needs to expose something that can detect when an account requires MFA and then set AWS_SESSION_TOKEN?

MacHu-GWU commented 2 years ago

@rkoval Yes, I recommend to implement in go this way:

  1. use some keyword like aws mfa-auth ${profile_name} ${six_digits_token}, ${profile_name} is the source named profile for mfa auth. If the account force mfa, then you can never use this profile directly.
  2. run some aws api call to get three values for future use. As an example, here's a shell script aws cli version I created long ago: https://github.com/MacHu-GWU/Dev-Exp-Share/blob/master/docs/source/01-AWS/00-AWS-Account-Management/05-Use-MFA-Protection/awscli-mfa-auth.sh
  3. find the region of the source region.
  4. persist 3 secret values and the region some where in ${HOME} directory, for instance ${HOME}/.alfred-aws-console-services-workflow/secrets.json is a good place. DON't USE THE ALFRED WORKFLOW DIRECTORY which is the /path-to/user.workflow.70776F59-2678-4404-B83C-1111222233334444. Because if the user export it, there's a risk that user expose his credential to public.
  5. In your workflow code logic, you can do this:
    1. try to load secrets from ${HOME}/..../secrets.json file. If success, then set environment variable accordingly. Now the new mfa authenticated profile will automatically work.
    2. if failed, then do the normal logic