export-aws-creds.rb

#!/usr/bin/env ruby

# Script to output bash commands to set environment variables for AWS access
# without needing to store the credentials anywhere.
#
# Use like this:
#
#   $ eval $(./export-aws-creds.rb track-a-query-production track-a-query-rds-output)
#

require "json"

namespace, secret_name = ARGV  # e.g. track-a-query-production track-a-query-rds-output

json = `cloud-platform decode-secret -n #{namespace} -s #{secret_name}`

secret = JSON.parse(json)

access_key_id = secret.dig("data", "access_key_id")
secret_access_key = secret.dig("data", "secret_access_key")

puts <<EOF
export AWS_REGION="eu-west-2"
export AWS_ACCESS_KEY_ID="#{access_key_id}"
export AWS_SECRET_ACCESS_KEY="#{secret_access_key}"
EOF

FYI, you can get the RDS instance identifier like this

db_instance_identifier = secret.dig("data", "rds_instance_endpoint").split(".").first