Get AWS credentials from a profile to inject into other programs
There are a number of other projects that extract AWS credentials and/or inject them into programs, but all the ones I've seen use the CLI's cache files directly, rather than leveraging botocore's ability to retrieve and refresh credentials. So I wrote this to do that.
botocore (the underlying Python SDK library) has added support for loading credentials cached by aws sso login
as of version 1.17.0.
aws-export-credentials
now requires botocore >= 1.17.0, and so supports AWS SSO credentials as well.
If all you want is AWS SSO support for an SDK other than Python, Go, or JavaScript (v3), take a look at aws-sso-util, which can help you configure your profiles with a credential process that doesn't require the credential injection process that aws-export-credentials
does.
I recommend you install pipx
, which installs the tool in an isolated virtualenv while linking the script you need.
# with pipx
pipx install aws-export-credentials
# without pipx
python3 -m pip install --user aws-export-credentials
# run it
aws-export-credentials
{
"Version": 1,
"AccessKeyId": "<your access key here>",
"SecretAccessKey": "<shhh it's your secret key>",
"SessionToken": "<do you ever wonder what's inside the session token?>"
}
Profiles work like in the AWS CLI (since it uses botocore); it will pick up the AWS_PROFILE
or AWS_DEFAULT_PROFILE
env vars, but the --profile
argument takes precedence.
aws-export-credentials --profile my-profile --json [--pretty]
Print the credentials to stdout as a JSON object compatible with the credential_process
spec. If --pretty
is added, it'll be pretty-printed.
aws-export-credentials --profile my-profile --env
export $(aws-export-credentials --profile my-profile --env)
eval $(aws-export-credentials --profile my-profile --env-export)
Print the credentials as environment variables. With --env-export
, the lines are prefixed
by "export
".
aws-export-credentials --profile my-profile --exec echo 'my access key id is $AWS_ACCESS_KEY_ID'
Execute the arguments after --exec
using os.system()
, injecting the credentials through
environment variables.
aws-export-credentials --profile my-profile --credentials-file-profile my-exported-profile
aws-export-credentials --profile my-profile -c my-exported-profile
Put the credentials in the given profile in your shared credentials file, which is typically ~/.aws/credentials
but can be controlled using the environment variable AWS_SHARED_CREDENTIALS_FILE
.
To avoid retrieving credentials every time when using aws-export-credentials
with the same identity, you can cache the credentials in a file using the --cache-file
argument.
Note aws-export-credentials
does not distinguish in the cache between different identities. Different identities should use different cache files.
If you do not account for this, credentials may be loaded from the cache and exported that do not correspond to the credentials that would be exported without the cache.
An example of a way to address this would be using a cache file named after the config profile you are exporting.
Cache loading and saving fails silently, to ensure caching does not interrupt usage.
If caching is not working, you can see the details with --debug
.
By default, cached credentials are considered expired if their expiration is less than 10 minutes in the future.
You can change this value using the --cache-expiration-buffer
argument, which takes a number of minutes.
You can force the cache to refresh using --refresh
.