Code samples for blog article on AWS profiles

01-aws-profile.ini

[padok]
aws_access_key_id = AKIA2EKSU7Q0RUO9M5WI
aws_secret_access_key = W8uVHOrecDxuufuSeY2OjYcGIemcxHz4KH9QsHKr

02-aws-profile.sh

export AWS_PROFILE=padok
aws ec2 describe-instances

03-aws-profile.go

sess, err := session.NewSession(&aws.Config{
    Credentials: credentials.NewSharedCredentials("", "padok"),
})

04-aws-profile-backend.tf

terraform {
  backend "s3" {
    bucket  = "padok-terraform-states"
    key     = "my-app"
    profile = "padok"
  }
}

05-aws-profile-provider.tf

provider "aws" {
  profile = "padok"
}

06-aws-profile-multiple-providers.tf

provider "aws" {
  alias   = "staging"
  profile = "padok_staging"
}

provider "aws" {
  alias   = "production"
  profile = "padok_production"
}

07-aws-profile-role-assumption.ini

[padok]
aws_access_key_id = AKIA2EKSU7Q0RUO9M5WI
aws_secret_access_key = W8uVHOrecDxuufuSeY2OjYcGIemcxHz4KH9QsHKr

[padok_staging]
source_profile = padok
role_arn = arn:aws:iam::000011112222:role/my-role

[padok_production]
source_profile = padok
role_arn = arn:aws:iam::333344445555:role/my-role

08-aws-profile-role-chaining.ini

[padok]
aws_access_key_id = AKIA2EKSU7Q0RUO9M5WI
aws_secret_access_key = W8uVHOrecDxuufuSeY2OjYcGIemcxHz4KH9QsHKr

[padok_production]
source_profile = padok
role_arn = arn:aws:iam::000011112222:role/my-role

[padok_production_alpha]
source_profile = padok_production
role_arn = arn:aws:iam::333344445555:role/my-role

[padok_production_bravo]
source_profile = padok_production
role_arn = arn:aws:iam::666677778888:role/my-role

09-aws-profile-mfa-setup.ini

# AWS credentials and MFA parameters for your IAM user.
# These fields are required to fill in the `padok_mfa` profile.
[padok]
aws_access_key_id = AKIA2EKSU7Q0RUO9M5WI
aws_secret_access_key = W8uVHOrecDxuufuSeY2OjYcGIemcxHz4KH9QsHKr
mfa_serial = arn:aws:iam::000011112222:mfa/my-user
mfa_seed = WOYA1FOALD24FCNVOLS8SQ552N8G600EZT480B16OZM3SD8A0UK3R1VJFB93XNIC

# This profile is filled in automatically by a script.
# The script uses the values in the `padok` profile to perform MFA authentication.
[padok_mfa]

10-aws-profile-mfa.sh

#!/usr/bin/env bash

set -e

echo "[$(date)] Updating credentials..."

ROOT_PROFILE="padok"
MFA_PROFILE="padok_mfa"

# Compute a single-use MFA code
MFA_SERIAL="$(aws configure get mfa_serial --profile $ROOT_PROFILE)"
MFA_SEED="$(aws configure get mfa_seed --profile $ROOT_PROFILE)"
MFA_TOKEN="$(oathtool -b --totp $MFA_SEED)"

# Fetch credentials from AWS with MFA code
CREDENTIALS="$(aws --profile $ROOT_PROFILE sts get-session-token --serial-number $MFA_SERIAL --token-code $MFA_TOKEN)"

# Parse output from previous command
SESSION_TOKEN="$(echo "${CREDENTIALS}" | jq -r '.Credentials.SessionToken')"
ACCESS_KEY_ID="$(echo "${CREDENTIALS}" | jq -r '.Credentials.AccessKeyId')"
SECRET_ACCESS_KEY="$(echo "${CREDENTIALS}" | jq -r '.Credentials.SecretAccessKey')"

# Set credentials in AWS credentials file
aws configure set profile.${MFA_PROFILE}.aws_access_key_id "$ACCESS_KEY_ID"
aws configure set profile.${MFA_PROFILE}.aws_secret_access_key "$SECRET_ACCESS_KEY"
aws configure set profile.${MFA_PROFILE}.aws_session_token "$SESSION_TOKEN"

echo "[$(date)] Credentials updated."

11-aws-profile-mfa-final.ini

# AWS credentials and MFA parameters for your IAM user.
# These fields are required to fill in the `padok_mfa` profile.
[padok]
aws_access_key_id = AKIA2EKSU7Q0RUO9M5WI
aws_secret_access_key = W8uVHOrecDxuufuSeY2OjYcGIemcxHz4KH9QsHKr
mfa_serial = arn:aws:iam::000011112222:mfa/my-user
mfa_seed = WOYA1FOALD24FCNVOLS8SQ552N8G600EZT480B16OZM3SD8A0UK3R1VJFB93XNIC

# This profile is filled in automatically by a script.
# The script uses the values in the `padok` profile to perform MFA authentication.
[padok_mfa]
aws_access_key_id = ASIA2934BCRXCO30VXYN
aws_secret_access_key = tkXrvAWiuMXewOl94lTQ2zuBNL3zRjlJ3dWzjET9
aws_session_token = a/very/long/token/string

12-aws-profile-mfa.crontab

0,30 * * * * PATH=/usr/bin:/bin:/usr/sbin:/sbin:/usr/local/bin ~/.aws/update-credentials.sh

13-aws-profile-full.ini

# AWS credentials and MFA parameters for your IAM user.
# These fields are required to fill in the `padok_mfa` profile.
[padok]
aws_access_key_id = AKIA2EKSU7Q0RUO9M5WI
aws_secret_access_key = W8uVHOrecDxuufuSeY2OjYcGIemcxHz4KH9QsHKr
mfa_serial = arn:aws:iam::000011112222:mfa/my-user
mfa_seed = WOYA1FOALD24FCNVOLS8SQ552N8G600EZT480B16OZM3SD8A0UK3R1VJFB93XNIC

# This profile is filled in automatically by a script.
# The script uses the values in the `padok` profile to perform MFA authentication.
[padok_mfa]

[padok_production]
source_profile = padok_mfa
role_arn = arn:aws:iam::000011112222:role/my-role

[padok_production_alpha]
source_profile = padok_production
role_arn = arn:aws:iam::333344445555:role/my-role

[padok_production_bravo]
source_profile = padok_production
role_arn = arn:aws:iam::666677778888:role/my-role

14-aws-profile-full.sh

export AWS_PROFILE=padok_production_alpha
aws ec2 describe-instances