aws-sso-refresh.sh

#!/bin/bash
# shellcheck enable=all disable=SC2154

export BROWSER=${2:-${BROWSER:-google-chrome-stable}}
export AWS_PROFILE=${1:-${AWS_PROFILE:-${AWS_DEFAULT_PROFILE:-default}}}

echo "Using profile '${AWS_PROFILE}'..."

echo "Checking if it's an SSO profile..."
if aws configure get sso_session &>/dev/null; then
	echo "Profile is an SSO profile."
else
	echo "Profile is not an SSO profile."
	exit 1
fi

echo "Checking login status..."
if aws sts get-caller-identity &>/dev/null; then
	echo "Already logged in."
else
	echo "Attempting SSO login..."
	if aws sso login; then
		echo "SSO login successful."
	else
		echo "SSO login failed."
		exit 1
	fi
fi

echo "Saving temp credentials..."
eval "$(aws configure export-credentials --format env || true)"
aws configure set aws_access_key_id "${AWS_ACCESS_KEY_ID}"
aws configure set aws_secret_access_key "${AWS_SECRET_ACCESS_KEY}"
aws configure set aws_session_token "${AWS_SESSION_TOKEN}"
awk -vs="[${AWS_PROFILE}]" -vk="x_security_token_expires" -vv="${AWS_CREDENTIAL_EXPIRATION}" \
	'$0==s{f=1;print;next}f&&$1==k{next}f&&/^\[/{print k" = "v;f=0}1;END{if(f)print k" = "v}' ~/.aws/credentials \
	>~/.aws/credentials.tmp && mv ~/.aws/credentials.tmp ~/.aws/credentials