contino/aws-google-auth repository overview

A Docker based Python project which generates temporary AWS STS credentials based on Google Apps SAML SSO authentication.

⁠Usage

There are a few ways to run this project. If you have a Yubikey, skip to Native Installation⁠ as Docker won't recognise the Yubikey device.

⁠1. 3Musketeers

This is handy when used in conjunction with other make based builds or if you don't have bash. See https://3musketeers.io⁠ for more details. Ensuring you have docker and make installed, run:

make .env

A new .env file will be generated for you. Fill in the correct environment variables such as GOOGLE_USERNAME and AWS_ROLE_ARN.

Note:

• AWS_ROLE_ARN is the ARN for the master account, and should always belong to 443332089211 i.e. arn:aws:iam::443332089211:role/firstname-lastname-account.

• If you specify a profile using the AWS_PROFILE environment variable, then you must have an empty profile with the same name in ~/.aws/config and ~/.aws/credentials. After this, any other roles you have will be able to source this role for credentials. See examples⁠ for more information.

Run:

make auth

⁠2. Bash

For situations where make isn't available, populate the variables in aws-google-auth.sh and run it:

sh ./aws-google-auth.sh

⁠2a. Native Installation

If you're using a Yubikey for your Two-factor Authentication (2FA), there are currently no working methods to enable Docker to see your device. Therefore, to make this work, you'll need to install the required packages with:

make install

And then authenticate with:

make native-auth

⁠Verification

You'll be prompted with a series of questions - specifically your Google password and 2FA code. Once you've authenticated, you'll see the following information populated in ~/.aws/config and ~/.aws/credentials:

• ~/.aws/config:

[profile contino-sso-sts]
region = eu-west-2
google_config.ask_role = False
google_config.keyring = False
google_config.duration = 21600
google_config.google_idp_id = C01dqpio3
google_config.role_arn = arn:aws:iam::443332089211:role/firstname-lastname-account
google_config.google_sp_id = 339654134938
google_config.u2f_disabled = False
google_config.google_username = [email protected]

• ~/.aws/credentials:

[contino-sso-sts]
aws_access_key_id = REDACTED
aws_secret_access_key = REDACTED
aws_security_token = REDACTED
aws_session_expiration = 2018-10-06T17:13:48+0000
aws_session_token = REDACTED

The example above assumes that the AWS_PROFILE you set in .env was named contino-sso-sts.

⁠Examples

Now that you have your temporary credentials for the master account in your ~/.aws directory, you can use these credentials in other roles. For example to assume the role for your personal Contino sandbox account, your full ~/.aws/config file would look like this:

To obtain your role_arn for the sandbox account, login to that account and navigate to here⁠. The Role arn to copy into your config is underneath Summmary.

[profile contino-sso-sts]
region = eu-west-2
google_config.ask_role = False
google_config.keyring = False
google_config.duration = 21600
google_config.google_idp_id = C01dqpio3
google_config.role_arn = arn:aws:iam::443332089211:role/firstname-lastname-account
google_config.google_sp_id = 339654134938
google_config.u2f_disabled = False
google_config.google_username = [email protected]

[profile contino-personal-sandbox]
region = eu-west-2
role_arn = arn:aws:iam::431143558948:role/OrganizationAccountAccessRole
source_profile = contino-sso-sts

# other example profiles

[profile contino-apac-dev]
region = ap-southeast-2
role_arn = arn:aws:iam::152848913167:role/OrganizationAccountAccessRole
source_profile = contino-sso-sts

[profile contino-yun]
region = ap-southeast-2
role_arn = arn:aws:iam::517691071176:role/OrganizationAccountAccessRole
source_profile = contino-sso-sts

You can now use the AWS profiles:

# use root acct creds (shouldn't work)
export AWS_PROFILE=contino-sso-sts
aws s3 ls

# assume role into personal Contino sandbox (should work)
export AWS_PROFILE=contino-personal-sandbox
aws s3 ls