# aws-creds-generator

At The Orchard, we have Multi-factor Authentication (MFA) enforced for all IAM user accounts, and in order to use certain AWS services, we need confirm our identities whether using the console and/or using the AWS CLI, by logging in with an MFA token. The only thing the user needs to do is input an MFA token. The script will automatically generate temporary credentials that will last for 12 hours and update the following lines in your repository's `.env` file if present:
```
export AWS_ACCESS_KEY_ID=
export AWS_SECRET_ACCESS_KEY=                                                                          
export AWS_SECURITY_TOKEN=
```

To use the script `awscli` mush be installed using your operating system package manager
```shell script
# For Mac OS X 
~$ brew install awscli  

# For Debian/Ubuntu     
~$ apt install awscli

# For CentOS/RedHat
~$ dnf install awscli
```

You need to have the following file present with your AWS credentials inside it:
```shell script
~/.aws/.store
```

The script will use `.store` file and treat it the master source for your AWS credentials to generate temporary ones. Your credentials in that file should have two profiles, one for our AWS Prod account, and another for the AWS Dev account. An example of how it should look:

```
[dev]
aws_access_key_id = foo
aws_secret_access_key = foo

[prod]
aws_access_key_id = boo
aws_secret_access_key = boo
```

Example use of this script:
```shell script
~$ ./generate.sh
```

You may supply an optional param for the profile name, rather than providing it interactively:
```shell script
~$ ./generate.sh prod
```

You may also supply an optional second param for the one-time auth token, rather than providing it interactively, e.g.:
```shell script
~$ ./generate.sh prod 123987
```

If you open a new terminal session, remember to run the following in order to use the temporary credentials:
```shell script
~$ export AWS_PROFILE=default
```

This script will manage:
 - Identifying your IAM user account by reading your credentials file in `~/.aws/credentials`.
 - Finding which MFA device you have attached to your account.
 - Prompts for an MFA token. (Enter the token using the authenticator attached to your AWS account)
 - Creating a backup of `~/.aws/credentials` and renamed to `~/.aws/.store`, if `~/.aws/.store` is not present.
 - Creating a new credentials file with a `[default]` profile that has the generated credentials.
 - Exporting the default profile in the same shell session where you ran the script.