Module: Awskeyring

Defined in:
lib/awskeyring.rb,
lib/awskeyring/input.rb,
lib/awskeyring/awsapi.rb,
lib/awskeyring/version.rb,
lib/awskeyring/validate.rb,
lib/awskeyring/credential_provider.rb

Overview

Awskeyring Module, gives you an interface to access keychains and items.

Defined Under Namespace

Modules: Awsapi, Input, Validate Classes: CredentialProvider

Constant Summary collapse

PREFS_FILE =

Default rpeferences fole path

(File.expand_path '~/.awskeyring').freeze
ROLE_PREFIX =

Prefix for Roles

'role '
ACCOUNT_PREFIX =

Prefix for Accounts

'account '
SESSION_KEY_PREFIX =

Prefix for Session Keys

'session-key '
SESSION_TOKEN_PREFIX =

Prefix for Session Tokens

'session-token '
FIVE_MINUTES =

Default keychain Lock period

300
DEFAULT_KEY_AGE =

Default warning of key age in days.

90
DEFAULT_CONSOLE_LIST =

Default Console Paths

%w[cloudformation ec2/v2 iam rds route53 s3 sns sqs vpc].freeze
DEFAULT_BROWSER_LIST =

Default Browsers

%w[Brave FireFox Opera Safari Vivaldi].freeze
VERSION =

The Gem’s version number

'1.11.0'
HOMEPAGE =

The Gem’s homepage

'https://github.com/tristanmorgan/awskeyring'
GEM_VERSION_URL =

RubyGems Version url

'https://rubygems.org/api/v1/versions/awskeyring/latest.json'

Class Method Summary collapse

Class Method Details

.access_key_not_exists(access_key) ⇒ Object

Validate access key does not exists

Parameters:

  • access_key (String) —

    the associated access key.



350
351
352
353
354
355
 
# File 'lib/awskeyring.rb', line 350

def self.access_key_not_exists(access_key)
  Awskeyring::Validate.access_key(access_key)
  raise 'Access KEY already exists' if (access_key)

  access_key
end

.account_exists(account_name) ⇒ Object

Validate account exists

Parameters:

  • account_name (String) —

    the associated account name.



330
331
332
333
334
335
 
# File 'lib/awskeyring.rb', line 330

def self.()
  Awskeyring::Validate.()
  raise 'Account does not exist' unless ( = solo_select(, ))

  
end

.account_not_exists(account_name) ⇒ Object

Validate account does not exists

Parameters:

  • account_name (String) —

    the associated account name.



340
341
342
343
344
345
 
# File 'lib/awskeyring.rb', line 340

def self.()
  Awskeyring::Validate.()
  raise 'Account already exists' if .include?()

  
end

.add_account(account:, key:, secret:, mfa:) ⇒ Object

Add an account item

Parameters:

  • account (String) —

    The account name to create

  • key (String) —

    The aws_access_key_id

  • secret (String) —

    The aws_secret_key

  • mfa (String) —

    The arn of the MFA device



118
119
120
121
122
123
124
125
 
# File 'lib/awskeyring.rb', line 118

def self.(account:, key:, secret:, mfa:)
  all_items.create(
    label: ACCOUNT_PREFIX + ,
    account: key,
    password: secret,
    comment: mfa
  )
end

.add_role(role:, arn:) ⇒ Object

Add a Role item

Parameters:

  • role (String) —

    The role name to add

  • arn (String) —

    The arn of the role



143
144
145
146
147
148
149
150
 
# File 'lib/awskeyring.rb', line 143

def self.add_role(role:, arn:)
  all_items.create(
    label: ROLE_PREFIX + role,
    account: arn,
    password: '',
    comment: ''
  )
end

.add_token(params = {}) ⇒ Object

add a session token pair of items

Parameters:

  • params (Hash) (defaults to: {}) —

    including account The name of the accont key The aws_access_key_id secret The aws_secret_access_key token The aws_sesson_token expiry time of expiry role The role used



161
162
163
164
165
166
167
168
169
170
 
# File 'lib/awskeyring.rb', line 161

def self.add_token(params = {})
  all_items.create(label: SESSION_KEY_PREFIX + params[:account],
                   account: params[:key],
                   password: params[:secret],
                   comment: params[:role].nil? ? '' : ROLE_PREFIX + params[:role])
  all_items.create(label: SESSION_TOKEN_PREFIX + params[:account],
                   account: params[:expiry],
                   password: params[:token],
                   comment: params[:role] || '')
end

.delete_account(account:, message:) ⇒ Object

Delete an Account

Parameters:

  • account (String) —

    The account to delete

  • message (String) —

    The message to display



306
307
308
309
310
311
312
313
 
# File 'lib/awskeyring.rb', line 306

def self.(account:, message:)
  delete_token(account: , message: I18n.t('message.delexpired'))
  cred = get_item(account: )
  return unless cred

  puts message if message
  cred.delete
end

.delete_role(role_name:, message:) ⇒ Object

Delete a role

Parameters:

  • role_name (String) —

    The role to delete

  • message (String) —

    The message to display



319
320
321
322
323
324
325
 
# File 'lib/awskeyring.rb', line 319

def self.delete_role(role_name:, message:)
  role = get_role(role_name: role_name)
  return unless role

  puts message if message
  role.delete
end

.delete_token(account:, message:) ⇒ Object

Delete a session token

Parameters:

  • account (String) —

    The account to delete a token for

  • message (String) —

    The message to display



297
298
299
300
 
# File 'lib/awskeyring.rb', line 297

def self.delete_token(account:, message:)
  session_key, session_token = get_token_pair(account: )
  delete_pair(key: session_key, token: session_token, message: message)
end

.get_role_arn(role_name:) ⇒ Object

get the ARN for a role

Parameters:

  • role_name (String) —

    The role name to retrieve



268
269
270
271
 
# File 'lib/awskeyring.rb', line 268

def self.get_role_arn(role_name:)
  role_item = get_role(role_name: role_name)
  role_item.attributes[:account] if role_item
end

.get_valid_creds(account:, no_token: false) ⇒ Object

Return valid creds for account

Parameters:

  • account (String) —

    The account to retrieve

  • no_token (Boolean) (defaults to: false) —

    Flag to skip tokens



250
251
252
253
254
255
256
257
258
259
260
261
262
263
 
# File 'lib/awskeyring.rb', line 250

def self.get_valid_creds(account:, no_token: false)
  cred, temp_cred = get_valid_item_pair(account: , no_token: no_token)
  token = temp_cred.password unless temp_cred.nil?
  expiry = temp_cred.attributes[:account].to_i unless temp_cred.nil?
  {
    account: ,
    expiry: expiry,
    key: cred.attributes[:account],
    mfa: no_token ? cred.attributes[:comment] : nil,
    secret: cred.password,
    token: token,
    updated: cred.attributes[:updated_at]
  }
end

.init_keychain(awskeyring:) ⇒ Object

Create a new Keychain

Parameters:

  • awskeyring (String) —

    The keychain name to create



47
48
49
50
51
52
53
54
55
56
57
58
59
 
# File 'lib/awskeyring.rb', line 47

def self.init_keychain(awskeyring:)
  keychain = Keychain.create(awskeyring)
  keychain.lock_interval = FIVE_MINUTES
  keychain.lock_on_sleep = true

  prefs = {
    awskeyring: awskeyring,
    keyage: DEFAULT_KEY_AGE,
    browser: DEFAULT_BROWSER_LIST,
    console: DEFAULT_CONSOLE_LIST
  }
  File.new(Awskeyring::PREFS_FILE, 'w').write JSON.dump(prefs)
end

.key_age ⇒ Object

Return Key age warning number



224
225
226
 
# File 'lib/awskeyring.rb', line 224

def self.key_age
  prefs.key?('keyage') ? prefs['keyage'] : DEFAULT_KEY_AGE
end

.latest_version ⇒ Object

Retrieve the latest version from RubyGems



18
19
20
21
22
23
 
# File 'lib/awskeyring/version.rb', line 18

def self.latest_version
  uri       = URI(GEM_VERSION_URL)
  request   = Net::HTTP.new(uri.host, uri.port)
  request.use_ssl = true
  JSON.parse(request.get(uri).body)['version']
end

.list_account_names ⇒ Object

Return a list account item names



190
191
192
193
194
195
196
 
# File 'lib/awskeyring.rb', line 190

def self.
  items = list_items.map { |elem| elem.attributes[:label][(ACCOUNT_PREFIX.length)..] }

  tokens = list_tokens.map { |elem| elem.attributes[:label][(SESSION_KEY_PREFIX.length)..] }

  (items + tokens).uniq.sort
end

.list_browsers ⇒ Object

Return a list of browserss



219
220
221
 
# File 'lib/awskeyring.rb', line 219

def self.list_browsers
  prefs.key?('browser') ? prefs['browser'] : DEFAULT_BROWSER_LIST
end

.list_console_path ⇒ Object

Return a list of console paths



214
215
216
 
# File 'lib/awskeyring.rb', line 214

def self.list_console_path
  prefs.key?('console') ? prefs['console'] : DEFAULT_CONSOLE_LIST
end

.list_role_names ⇒ Object

Return a list role item names



199
200
201
 
# File 'lib/awskeyring.rb', line 199

def self.list_role_names
  list_roles.map { |elem| elem.attributes[:label][(ROLE_PREFIX.length)..] }.sort
end

.list_role_names_plus ⇒ Object

Return a list role item names and arns



209
210
211
 
# File 'lib/awskeyring.rb', line 209

def self.list_role_names_plus
  list_roles.map { |elem| "#{elem.attributes[:label][(ROLE_PREFIX.length)..]}\t#{elem.attributes[:account]}" }
end

.list_token_names ⇒ Object

Return a list token item names



204
205
206
 
# File 'lib/awskeyring.rb', line 204

def self.list_token_names
  list_tokens.map { |elem| elem.attributes[:label][(SESSION_KEY_PREFIX.length)..] }.sort
end

.prefs ⇒ Hash

Retrieve the preferences

Returns:

  • (Hash) —

    prefs of the gem



36
37
38
39
40
41
42
 
# File 'lib/awskeyring.rb', line 36

def self.prefs
  if File.exist? PREFS_FILE
    JSON.parse(File.read(PREFS_FILE))
  else
    {}
  end
end

.role_arn_not_exists(role_arn) ⇒ Object

Validate role arn not exists

Parameters:

  • role_arn (String) —

    the associated role arn.



390
391
392
393
394
395
 
# File 'lib/awskeyring.rb', line 390

def self.role_arn_not_exists(role_arn)
  Awskeyring::Validate.role_arn(role_arn)
  raise 'Role ARN already exists' if (role_arn)

  role_arn
end

.role_exists(role_name) ⇒ Object

Validate role exists

Parameters:

  • role_name (String) —

    the associated role name.



360
361
362
363
364
365
 
# File 'lib/awskeyring.rb', line 360

def self.role_exists(role_name)
  Awskeyring::Validate.role_name(role_name)
  raise 'Role does not exist' unless (role_name = solo_select(list_role_names, role_name))

  role_name
end

.role_not_exists(role_name) ⇒ Object

Validate role does not exists

Parameters:

  • role_name (String) —

    the associated role name.



370
371
372
373
374
375
 
# File 'lib/awskeyring.rb', line 370

def self.role_not_exists(role_name)
  Awskeyring::Validate.role_name(role_name)
  raise 'Role already exists' if list_role_names.include?(role_name)

  role_name
end

.solo_select(list, prefix) ⇒ Object

return item that matches a prefix if only one.



102
103
104
105
106
107
108
109
110
 
# File 'lib/awskeyring.rb', line 102

def self.solo_select(list, prefix)
  return prefix if list.include?(prefix)

  list.select! { |elem| elem.start_with?(prefix) }

  return list.first if list.length == 1

  nil
end

.token_exists(token_name) ⇒ Object

Validate token exists

Parameters:

  • token_name (String) —

    the associated account name.



380
381
382
383
384
385
 
# File 'lib/awskeyring.rb', line 380

def self.token_exists(token_name)
  Awskeyring::Validate.(token_name)
  raise 'Token does not exist' unless (token_name = solo_select(list_token_names, token_name))

  token_name
end

.update_account(account:, key:, secret:) ⇒ Object

update and account item

Parameters:

  • account (String) —

    The account to update

  • key (String) —

    The aws_access_key_id

  • secret (String) —

    The aws_secret_key



132
133
134
135
136
137
 
# File 'lib/awskeyring.rb', line 132

def self.(account:, key:, secret:)
  item = get_item(account: )
  item.attributes[:account] = key
  item.password = secret
  item.save!
end