AWS CloudFormation

aws-cli-saml-auth.sh

#!/bin/bash
# A shell script to help getting SAML credentials into `~/.aws/credentials`

# Login URL https://sts.asdasd.com/adfs/ls/idpinitiatedsignon.aspx?loginToRp=urn:amazon:webservices

LSE_AWS_ACCOUNT=0123456789
LSE_AWS_ROLE="asdasdasd-role"
LSE_AWS_PROFILE="asdasd-saml"
LSE_SAML_PROVIDER="STS.ASDASD.COM"
LSE_SAML_RESPONSE="PHNhbWxwOlJlc3 [..] vbnNlPg=="

aws sts assume-role-with-saml \
    --role-arn "arn:aws:iam::${LSE_AWS_ACCOUNT}:role/${LSE_AWS_ROLE}" \
    --principal-arn "arn:aws:iam::${LSE_AWS_ACCOUNT}:saml-provider/${LSE_SAML_PROVIDER}" \
    --saml-assertion "${LSE_SAML_RESPONSE}" \
    | awk -F:  '
    BEGIN { RS = "[,{}]"; print "['${LSE_AWS_PROFILE}']"}
    /:/{ gsub(/"/, "", $2) }
    /AccessKeyId/{ print "aws_access_key_id = " $2 }
    /SecretAccessKey/{ print "aws_secret_access_key = " $2 }
    /SessionToken/{ print "aws_session_token = " $2 }
    END { print "\n" }
'

regexp_collection.md

A collection of usefull regexp

Validate AWS CloudFormation CIDR Blocks (VPC and subnets)

allow only RFC 1918 classes, excluding localhost and being between /16 and /28

AllowedPattern: '^(?:10\.(?:25[0-5]|2[0-4][0-9]|1?[0-9]{1,2})|172\.(?:1[6-9]|2[0-9]|3[0-1])|192\.168)(?:\.(?:25[0-5]|2[0-4][0-9]|1?[0-9]{1,2})){2}/(?:2[0-8]|1[6-9])$'