Module: Awskeyring

Defined in:
lib/awskeyring.rb,
lib/awskeyring/input.rb,
lib/awskeyring/awsapi.rb,
lib/awskeyring/version.rb,
lib/awskeyring/validate.rb

Overview

Awskeyring Module, gives you an interface to access keychains and items.

Defined Under Namespace

Modules: Awsapi, Input, Validate

Constant Summary collapse

PREFS_FILE =

Default rpeferences fole path

(File.expand_path '~/.awskeyring').freeze
ROLE_PREFIX =

Prefix for Roles

'role '
ACCOUNT_PREFIX =

Prefix for Accounts

'account '
SESSION_KEY_PREFIX =

Prefix for Session Keys

'session-key '
SESSION_TOKEN_PREFIX =

Prefix for Session Tokens

'session-token '
FIVE_MINUTES =

Default keychain Lock period

300
DEFAULT_KEY_AGE =

Default warning of key age in days.

90
DEFAULT_CONSOLE_LIST =

Default Console Paths

%w[cloudformation ec2/v2 iam rds route53 s3 sns sqs vpc].freeze
VERSION =

The Gem’s version number

'1.4.0'
HOMEPAGE =

The Gem’s homepage

'https://github.com/servian/awskeyring'
GEM_VERSION_URL =

RubyGems Version url

'https://rubygems.org/api/v1/versions/awskeyring/latest.json'

Class Method Summary collapse

Class Method Details

.access_key_not_exists(access_key) ⇒ Object

Validate access key does not exists

Parameters:

  • access_key (String) —

    the associated access key.



331
332
333
334
335
336
 
# File 'lib/awskeyring.rb', line 331

def self.access_key_not_exists(access_key)
  Awskeyring::Validate.access_key(access_key)
  raise 'Access KEY already exists' if (access_key)

  access_key
end

.account_exists(account_name) ⇒ Object

Validate account exists

Parameters:

  • account_name (String) —

    the associated account name.



311
312
313
314
315
316
 
# File 'lib/awskeyring.rb', line 311

def self.()
  Awskeyring::Validate.()
  raise 'Account does not exist' unless .include?()

  
end

.account_not_exists(account_name) ⇒ Object

Validate account does not exists

Parameters:

  • account_name (String) —

    the associated account name.



321
322
323
324
325
326
 
# File 'lib/awskeyring.rb', line 321

def self.()
  Awskeyring::Validate.()
  raise 'Account already exists' if .include?()

  
end

.add_account(account:, key:, secret:, mfa:) ⇒ Object

Add an account item

Parameters:

  • account (String) —

    The account name to create

  • key (String) —

    The aws_access_key_id

  • secret (String) —

    The aws_secret_key

  • mfa (String) —

    The arn of the MFA device



104
105
106
107
108
109
110
111
 
# File 'lib/awskeyring.rb', line 104

def self.(account:, key:, secret:, mfa:)
  all_items.create(
    label:  + ,
    account: key,
    password: secret,
    comment: mfa
  )
end

.add_role(role:, arn:) ⇒ Object

Add a Role item

Parameters:

  • role (String) —

    The role name to add

  • arn (String) —

    The arn of the role



129
130
131
132
133
134
135
136
 
# File 'lib/awskeyring.rb', line 129

def self.add_role(role:, arn:)
  all_items.create(
    label: ROLE_PREFIX + role,
    account: arn,
    password: '',
    comment: ''
  )
end

.add_token(params = {}) ⇒ Object

add a session token pair of items

Parameters:

  • params (Hash) (defaults to: {}) —

    including account The name of the accont key The aws_access_key_id secret The aws_secret_access_key token The aws_sesson_token expiry time of expiry role The role used



147
148
149
150
151
152
153
154
155
156
 
# File 'lib/awskeyring.rb', line 147

def self.add_token(params = {})
  all_items.create(label: SESSION_KEY_PREFIX + params[:account],
                   account: params[:key],
                   password: params[:secret],
                   comment: params[:role].nil? ? '' : ROLE_PREFIX + params[:role])
  all_items.create(label: SESSION_TOKEN_PREFIX + params[:account],
                   account: params[:expiry],
                   password: params[:token],
                   comment: params[:role] || '')
end

.delete_account(account:, message:) ⇒ Object

Delete an Account

Parameters:

  • account (String) —

    The account to delete

  • message (String) —

    The message to display



287
288
289
290
291
292
293
294
 
# File 'lib/awskeyring.rb', line 287

def self.(account:, message:)
  delete_token(account: , message: I18n.t('message.delexpired'))
  cred = get_item(account: )
  return unless cred

  puts message if message
  cred.delete
end

.delete_role(role_name:, message:) ⇒ Object

Delete a role

Parameters:

  • role_name (String) —

    The role to delete

  • message (String) —

    The message to display



300
301
302
303
304
305
306
 
# File 'lib/awskeyring.rb', line 300

def self.delete_role(role_name:, message:)
  role = get_role(role_name: role_name)
  return unless role

  puts message if message
  role.delete
end

.delete_token(account:, message:) ⇒ Object

Delete a session token

Parameters:

  • account (String) —

    The account to delete a token for

  • message (String) —

    The message to display



278
279
280
281
 
# File 'lib/awskeyring.rb', line 278

def self.delete_token(account:, message:)
  session_key, session_token = get_token_pair(account: )
  delete_pair(key: session_key, token: session_token, message: message)
end

.get_role_arn(role_name:) ⇒ Object

get the ARN for a role

Parameters:

  • role_name (String) —

    The role name to retrieve



249
250
251
252
 
# File 'lib/awskeyring.rb', line 249

def self.get_role_arn(role_name:)
  role_item = get_role(role_name: role_name)
  role_item.attributes[:account] if role_item
end

.get_valid_creds(account:, no_token: false) ⇒ Object

Return valid creds for account

Parameters:

  • account (String) —

    The account to retrieve

  • no_token (Boolean) (defaults to: false) —

    Flag to skip tokens



231
232
233
234
235
236
237
238
239
240
241
242
243
244
 
# File 'lib/awskeyring.rb', line 231

def self.get_valid_creds(account:, no_token: false)
  cred, temp_cred = get_valid_item_pair(account: , no_token: no_token)
  token = temp_cred.password unless temp_cred.nil?
  expiry = temp_cred.attributes[:account].to_i unless temp_cred.nil?
  {
    account: ,
    expiry: expiry,
    key: cred.attributes[:account],
    mfa: no_token ? cred.attributes[:comment] : nil,
    secret: cred.password,
    token: token,
    updated: cred.attributes[:updated_at]
  }
end

.init_keychain(awskeyring:) ⇒ Object

Create a new Keychain

Parameters:

  • awskeyring (String) —

    The keychain name to create



45
46
47
48
49
50
51
52
53
54
55
56
 
# File 'lib/awskeyring.rb', line 45

def self.init_keychain(awskeyring:)
  keychain = Keychain.create(awskeyring)
  keychain.lock_interval = FIVE_MINUTES
  keychain.lock_on_sleep = true

  prefs = {
    awskeyring: awskeyring,
    keyage: DEFAULT_KEY_AGE,
    console: DEFAULT_CONSOLE_LIST
  }
  File.new(Awskeyring::PREFS_FILE, 'w').write JSON.dump(prefs)
end

.key_age ⇒ Object

Return Key age warning number



205
206
207
 
# File 'lib/awskeyring.rb', line 205

def self.key_age
  prefs.key?('keyage') ? prefs['keyage'] : DEFAULT_KEY_AGE
end

.latest_version ⇒ Object

Retrieve the latest version from RubyGems



18
19
20
21
22
23
 
# File 'lib/awskeyring/version.rb', line 18

def self.latest_version
  uri       = URI(GEM_VERSION_URL)
  request   = Net::HTTP.new(uri.host, uri.port)
  request.use_ssl = true
  JSON.parse(request.get(uri).body)['version']
end

.list_account_names ⇒ Object

Return a list account item names



176
177
178
179
180
181
182
 
# File 'lib/awskeyring.rb', line 176

def self.
  items = list_items.map { |elem| elem.attributes[:label][(.length)..-1] }

  tokens = list_tokens.map { |elem| elem.attributes[:label][(SESSION_KEY_PREFIX.length)..-1] }

  (items + tokens).uniq.sort
end

.list_console_path ⇒ Object

Return a list of console paths



200
201
202
 
# File 'lib/awskeyring.rb', line 200

def self.list_console_path
  prefs.key?('console') ? prefs['console'] : DEFAULT_CONSOLE_LIST
end

.list_role_names ⇒ Object

Return a list role item names



185
186
187
 
# File 'lib/awskeyring.rb', line 185

def self.list_role_names
  list_roles.map { |elem| elem.attributes[:label][(ROLE_PREFIX.length)..-1] }.sort
end

.list_role_names_plus ⇒ Object

Return a list role item names and arns



195
196
197
 
# File 'lib/awskeyring.rb', line 195

def self.list_role_names_plus
  list_roles.map { |elem| "#{elem.attributes[:label][(ROLE_PREFIX.length)..-1]}\t#{elem.attributes[:account]}" }
end

.list_token_names ⇒ Object

Return a list token item names



190
191
192
 
# File 'lib/awskeyring.rb', line 190

def self.list_token_names
  list_tokens.map { |elem| elem.attributes[:label][(SESSION_KEY_PREFIX.length)..-1] }.sort
end

.prefs ⇒ Hash

Retrieve the preferences

Returns:

  • (Hash) —

    prefs of the gem



34
35
36
37
38
39
40
 
# File 'lib/awskeyring.rb', line 34

def self.prefs
  if File.exist? PREFS_FILE
    JSON.parse(File.read(PREFS_FILE))
  else
    {}
  end
end

.role_arn_not_exists(role_arn) ⇒ Object

Validate role arn not exists

Parameters:

  • role_arn (String) —

    the associated role arn.



371
372
373
374
375
376
 
# File 'lib/awskeyring.rb', line 371

def self.role_arn_not_exists(role_arn)
  Awskeyring::Validate.role_arn(role_arn)
  raise 'Role ARN already exists' if (role_arn)

  role_arn
end

.role_exists(role_name) ⇒ Object

Validate role exists

Parameters:

  • role_name (String) —

    the associated role name.



341
342
343
344
345
346
 
# File 'lib/awskeyring.rb', line 341

def self.role_exists(role_name)
  Awskeyring::Validate.role_name(role_name)
  raise 'Role does not exist' unless list_role_names.include?(role_name)

  role_name
end

.role_not_exists(role_name) ⇒ Object

Validate role does not exists

Parameters:

  • role_name (String) —

    the associated role name.



351
352
353
354
355
356
 
# File 'lib/awskeyring.rb', line 351

def self.role_not_exists(role_name)
  Awskeyring::Validate.role_name(role_name)
  raise 'Role already exists' if list_role_names.include?(role_name)

  role_name
end

.token_exists(token_name) ⇒ Object

Validate token exists

Parameters:

  • token_name (String) —

    the associated account name.



361
362
363
364
365
366
 
# File 'lib/awskeyring.rb', line 361

def self.token_exists(token_name)
  Awskeyring::Validate.(token_name)
  raise 'Token does not exist' unless list_token_names.include?(token_name)

  token_name
end

.update_account(account:, key:, secret:) ⇒ Object

update and account item

Parameters:

  • account (String) —

    The account to update

  • key (String) —

    The aws_access_key_id

  • secret (String) —

    The aws_secret_key



118
119
120
121
122
123
 
# File 'lib/awskeyring.rb', line 118

def self.(account:, key:, secret:)
  item = get_item(account: )
  item.attributes[:account] = key
  item.password = secret
  item.save!
end