AWS プロファイル切り替えのストレスを解消！「Granted」で IAM ロールと SSO の管理を効率化してみた

$ brew tap common-fate/granted
$ brew install granted

$ granted -v
Granted version: 0.38.0

### ~/.aws/credentials
[test-secret]
aws_access_key_id     = <ACCESS_KEY>
aws_secret_access_key = <SECRET_KEY>

### ~/.aws/config (リージョンや出力形式はご自由に)
[profile test-role]
source_profile = test-secret
role_arn       = arn:aws:iam::<ACCOUNT_ID>:role/<ROLE_NAME>
mfa_serial     = arn:aws:iam::<ACCOUNT_ID>:mfa/<MFA_DEVICE>  # MFA を利用する場合は記述
region         = ap-northeast-1
output         = json

### ~/.aws/config (リージョンや出力形式はご自由に)
[profile TestAccount/AdministratorAccess]
sso_start_url  = https://<Identifier>.awsapps.com/start
sso_region     = <SSO_REGION>
sso_account_id = <ACCOUNT_ID>
sso_role_name  = <SSO_ROLE_NAME>
region         = ap-northeast-1
output         = json

$ assume

[i] Thanks for using Granted!
[i] By default, Granted will open the AWS console with this browser: Brave
[!] Granted works best with Firefox but also supports Chrome, Brave, and Edge (https://docs.commonfate.io/granted/introduction#supported-browsers). You can change this setting later by running 'granted browser set'
? Use Firefox as default Granted browser? (Y/n) n  # Brave を利用するため n を入力
[✔] Granted will default to using Brave
? Use a different browser than your default browser for SSO login? [? for help] (y/N) N # SSO ログインにブラウザを利用するか聞かれますが、デフォルトのブラウザを利用するので N を入力
[i] To change the web browser that Granted uses run: `granted browser -set`

[i] Here's how to use Granted to supercharge your cloud access:
[i] `assume`                   - search profiles to assume
[i] `assume <PROFILE_NAME>`    - assume a profile
[i] `assume -c <PROFILE_NAME>` - open the console for the specified profile

$ assume
[i] To assume roles with Granted, we need to add an alias to your shell profile (https://docs.commonfate.io/granted/internals/shell-alias)
? Install zsh alias at /Users/xxxx/.dotfiles/configs/zsh/.zshenv (Y/n) Y

[✔] Added the Granted alias to /Users/xxxx/.dotfiles/configs/zsh/.zshenv
[!] Shell restart required to apply changes: please open a new terminal window and re-run your command.

$ assume

? Please select the profile you would like to assume:  [Use arrows to move, type to filter]

> test-role
  test-sso 

$ assume test-role
? MFA Token 000000
[!] Profile test-role has plaintext credentials stored in the AWS credentials file
[i] To move the credentials to secure storage, run 'granted credentials import test-role'
[✔] [test-role](ap-northeast-1) session credentials will expire in 1 hour

### Granted のセキュアなストレージに認証情報を移行する ###
# ~/.aws/credentials` から認証情報が削除され Granted が提供するセキュアなストレージに認証情報を移行 (暗号化される)
$ granted credentials import test-role

### 従来の `~/.aws/credentials` に AWS 認証情報を戻す方法 ###
# 1. セキュアなストレージに保存されているクレデンシャルのプロファイル名を表示する
$ granted credentials list

# 2. `~/.aws/credentials` に認証情報を戻す
$ granted credentials export-plaintext <PROFILE_NAME>

# 3. Granted のセキュアなストレージから認証情報を削除する
$ granted credentials remove <PROFILE_NAME>

$ assume TestAccount/AdministratorAccess
[!] error retrieving IAM Identity Center token from secure storage: The specified item could not be found in the keyring
[i] If the browser does not open automatically, please open this link: https://xxxxxx.awsapps.com/start/#/device?user_code=DZWC-QKXV
[i] Awaiting AWS authentication in the browser
[i] You will be prompted to authenticate with AWS in the browser, then you will be prompted to 'Allow'
[i] Code: DZWC-QKXV

[✔] [TestAccount/AdministratorAccess](ap-northeast-1) session credentials will expire in 8 hours

# 現在のセッションを確認する
$ granted cache list
STORAGE TYPE            KEY
sso-token               https://xxxx.awsapps.com/start
session-credentials     test-role

# すべてのセッションをクリアする
# ※ STORAGE TYPE ごとでも削除できますので help を参照してください
$ granted cache clear --all

$ granted settings profile-order set

? Select filter type Alphabetical
[✔] Set profile ordering to: Alphabetical

$ granted completion -s zsh
[✔] ZSH autocompletions generated successfully
[!] A shell restart is required to apply changes, please open a new terminal to test that autocomplete is working

$ assume <TABを押す>
test-role                        TestAccount/AdministratorAccess

# とくになにも指定しない場合、Granted はデフォルトの 1 時間を設定する
$ assume test-role
[✔] [test-role](ap-northeast-1) session credentials will expire in 1 hour

# 4 時間の期間を指定してログインする場合
$ assume test-role --duration 4h
[✔] [test-role](ap-northeast-1) session credentials will expire in 4 hours

# 最大期間外を指定するとエラーになる
$ assume test-role --duration 13h
[✘] failed to refresh cached credentials, failed to refresh cached credentials, operation error STS: AssumeRole, https response error StatusCode: 400, RequestID: xxxxx, api error ValidationError: 1 validation error detected: Value '46800' at 'durationSeconds' failed to satisfy constraint: Member must have value less than or equal to 43200

# プロファイルを選択してコンソールを開く
$ assume -c

# 特定のプロファイルを指定してコンソールを開く
$ assume -c test-role 

# ブラウザプロファイルを指定してコンソールを開く
$ assume -c test-role --browser-profile "AWS コンソール用"

# 特定のリージョンのコンソールを開く
$ assume -c test-role -r ap-northeast-1

# 特定のサービスのコンソールを開く
$ assume -c test-role -s s3

# 特定のコンソールの URL を指定して開く
$ assume -c test-role -cd https://console.aws.amazon.com/cloudwatch/home?region=ap-northeast-1#dashboards:name=MyDashboard

# ~/.zshenv に以下を追加
alias cw-dashboard='assume -c test-role -cd https://console.aws.amazon.com/cloudwatch/home?region=ap-northeast-1#dashboards:name=MyDashboard'

# AWS プロファイルを定義
$ cat profile_list.txt
test-role
TestAccount/AdministratorAccess

# 非インタラクティブな環境では FORCE_NO_ALIAS=true オプションを指定して assume コマンドを実行しましょう
# エイリアスの存在が予期せぬ動作を引き起こす可能性があります
for PROFILE in $(cat profile_list.txt); do
  echo "--- Processing profile: $PROFILE ---"
  FORCE_NO_ALIAS=true assume "$PROFILE" --exec "aws sts get-caller-identity --query Account --output text"
done

### 出力例
--- Processing profile: test-role ---
[✔] [test-role](ap-northeast-1) session credentials will expire in 58 minutes
111111111111
--- Processing profile: TestAccount/AdministratorAccess ---
[✔] [TestAccount/AdministratorAccess](ap-northeast-1) session credentials will expire in 8 hours
222222222222

# .env ファイルにエクスポート (プロファイルの指定も可能)
$ assume --env

## .env ファイルが存在しない場合は作成するかどうかを聞かれますので、問題なければ `y` を入力します
? No .env file found in the current directory, would you like to create one? Yes
[✔] Successfully created a new .env file in the current directory
[✔] Exported credentials to .env file successfully

# ~/.zshenv に以下を追加
export GRANTED_ENABLE_AUTO_REASSUME=true