trek10inc / awsume

A utility for easily assuming AWS IAM roles from the command line.
https://awsu.me
MIT License
487 stars 90 forks source link

Detect when MFA is needed #124

Closed okelet closed 3 years ago

okelet commented 3 years ago

In order to make a script to automate some tasks, it is necessary to know if MFA is needed, or if it has been set previously. When running for example from a webapp, this code:

awsumepy.awsume('xxx')

Prints the MFA input in the stdout, hanging the full app. It would be useful an option to skip asking the MFA and return a code ($?) different than 0 to reflect that situation when running the command, or throw an exception when running programatically.

mbarneyjr commented 3 years ago

I think the approach that would be best suited here would be to look the profile yourself to determine if mfa is required (the profile has an mfa_serial property), so you don't have to execute everything awsume does between gathering profiles and prompting for mfa if necessary

This is made easier with the latest pre release that adds support for non-interactively getting all profiles available to you, as mentioned in #123, so in psuedo-code it might look like this:

from awsume.awsumepy import awsume
data = awsume('-l') # or data = awsume(list_profiles=True)
profile = data.get('profiles', {}).get('<PROFILE_NAME>', {})
mfa_required = 'mfa_serial' in profile

I'll close this issue since support for this is on the way