Skip to content

Latest commit

 

History

History
85 lines (68 loc) · 6.02 KB

README.md

File metadata and controls

85 lines (68 loc) · 6.02 KB
Raw

AWS tools

Collection of tools to make working with AWS a bit easier without having to depend on awscli and python.

List of tools

Tool Overview
aws-dump Dumps (a subset of) AWS resources metadata to JSON and optionally check if they are in terraform state.
iam-session Creates new IAM session with role assumption and MFA support.
iam-public-keys Returns the public SSH keys of an IAM user.
iam-sync-users Create Linux users from IAM
iam-request-ssh-key-signature Request SSH key signature from a CA managed by lambda-sign-ssh-key.
lambda-sign-ssh-key Sign SSH keys from a CA using the caller's identity to set the principals.
iam-auth-proxy Use IAM as identity provider for services.
cloudwatch-put-metric-data Basic sending a metric value to cloudwatch
ec2-describe-instances Describe EC2 instances by id or filter
ec2-ip-from-name Given an EC2 name, list up to -max-results IPs associated with instances with that name
ecr-get-login Prints out the command to run to auth with docker ECR. Check output flag for other options
ecs-dashboard Shows ECS services and their version across multiple AWS accounts.
ecs-locate Returns ip:port for containers of an ECS service
ecs-deploy Update the container images of a task and update services to use it
ecs-run-task Runs a task definition
elb-resolve-elb-external-url ELB classic only (no ALB). Given a name returns the zone53 record associated with the ELB, including scheme (https returned if both available) and port.
elb-resolve-alb-external-url Both ELB classic and ALB. Given a name, returns route53 record associated with the ELB. Does not include scheme or port as it doesn't check listeners.
lambda-ping Pings a URL with lambda and publish a custom cloudwatch metric with the result.
s3-download Download a single file from s3.
kms-env Decrypts environment variables from SSM, KMS or Secret Manager and runs a command.

Authentication

Every tool supports the standard AWS authentication as well as sts sessions with the following options

  • --region: Choose the aws-region to use
  • --assume-role-arn: Assume the role before running. This is useful for cross account access.
  • --assume-role-policy: Policy to use when assuming the role, can be used to drop permissions from the role.
  • --mfa-serial-number: The new session will have its 2FA flag set.
  • --mfa-token-code: The token code to use when using --mfa-serial-number. If not provided the tool will prompt for it.
  • --session-duration: The length of the session, for example --session-duration=1h

Releases

All tools are available under different formats on the release page.

  • Linux binaries (All tools)
  • MacOS binaries (Most tools)
  • .deb package
  • .rpm package

Check the release tab for the latest release.

Checking release signatures

Download the signature from the release and use GPG to verify it

#!/usr/bin/env bash
version=7.4.0
os=linux
arch=amd64
wget https://github.com/hamstah/awstools/releases/download/v${version}/aws-dump_${version}_${os}_${arch} -O aws-dump
wget https://github.com/hamstah/awstools/releases/download/v${version}/aws-dump_${version}_${os}_${arch}.asc -O aws-dump.asc
gpg --verify aws-dump.asc aws-dump

The signing key is

Primary key fingerprint: 5FC5 40A9 A2F2 B87B 9C49  3D9E 7D40 F516 7D5C 7058

Checking the sha256 of binaries

  • Get the SHA256SUMS files 
    #!/usr/bin/env bash
version=7.4.0

wget https://github.com/hamstah/awstools/releases/download/v${version}/SHA256SUMS
wget https://github.com/hamstah/awstools/releases/download/v${version}/SHA256SUMS.asc
gpg --verify SHA256SUMS.asc SHA256SUMS
  • Check the sha256 of downloaded binaries 
    find . -type f ! -name "*.asc" ! -name SHA256SUMS | xargs -Ifile grep file SHA256SUMS | sha256sum --check