mvisonneau/vac repository overview

~$ go get -u github.com/mvisonneau/vac

~$ brew install mvisonneau/tap/vac

~$ docker run -it --rm mvisonneau/vac

~$ scoop bucket add https://github.com/mvisonneau/scoops
~$ scoop install vac

~$ export VAC_VERSION=$(curl -s "https://api.github.com/repos/mvisonneau/vac/releases/latest" | grep '"tag_name":' | sed -E 's/.*"([^"]+)".*/\1/')

# Binary (eg: linux/amd64)
~$ wget https://github.com/mvisonneau/vac/releases/download/${VAC_VERSION}/vac_${VAC_VERSION}_linux_amd64.tar.gz
~$ tar zxvf vac_${VAC_VERSION}_linux_amd64.tar.gz -C /usr/local/bin

# DEB package (eg: linux/386)
~$ wget https://github.com/mvisonneau/vac/releases/download/${VAC_VERSION}/vac_${VAC_VERSION}_linux_386.deb
~$ dpkg -i vac_${VAC_VERSION}_linux_386.deb

# RPM package (eg: linux/arm64)
~$ wget https://github.com/mvisonneau/vac/releases/download/${VAC_VERSION}/vac_${VAC_VERSION}_linux_arm64.rpm
~$ rpm -ivh vac_${VAC_VERSION}_linux_arm64.rpm

~$ cat - <<EOF >> ~/.aws/credentials

[vac]
credential_process = $(which vac) get
EOF

~$ export AWS_PROFILE=vac

~$ vac
[follow prompt]

~$ vac --help
NAME:
   vac - Manage AWS credentials dynamically using Vault

USAGE:
   vac [global options] command [command options] [arguments...]

COMMANDS:
   get      get the creds in credential_process format (json)
   status   returns some info about the current context, cached credentials and Vault server connectivity
   help, h  Shows a list of commands or help for one command

GLOBAL OPTIONS:
   --engine path, -e path  engine path [$VAC_ENGINE]
   --role name, -r name    role name [$VAC_ROLE]
   --state path, -s path   state path (default: "~/.vac_state") [$VAC_STATE_PATH]
   --log-level level       log level (debug,info,warn,fatal,panic) (default: "info") [$VAC_LOG_LEVEL]
   --log-format format     log format (json,text) (default: "text") [$VAC_LOG_FORMAT]
   --help, -h              show help

# ~/.aws/credentials
[default]
credential_process = /usr/local/bin/vac get
[dev-admin]
credential_process = /usr/local/bin/vac -e dev -r admin get
[staging-admin]
credential_process = /usr/local/bin/vac -e staging -r admin get

# only prompt for chosing a role in the "dev" engine
~$ vac -e dev

# no prompt, automatically switch to "admin" role in the "dev" engine
~$ vac -e dev -r admin

~$ vac get --help
NAME:
   vac get - get the creds in credential_process format (json)

USAGE:
   vac get [command options] [arguments...]

OPTIONS:
   --min-ttl duration           min-ttl duration (default: 0s) [$VAC_MIN_TTL]
   --ttl duration, -t duration  ttl duration (default: 0s) [$VAC_TTL]
   --force-generate, -f         bypass currently cached creds and generate new ones [$VAC_FORCE_GENERATE]

# Generate credentials valid for 1h
~$ vac get --ttl 1h

# Generate credentials valid for 1h but replace them if existing ones expire in less than 30m
~$ vac get --ttl 1h --min-ttl 30m

# Generate credentials valid for 2h, indepently if some valid ones are still present in the cache
~$ vac get --ttl 2 -f

~$ cat - <<EOF >> ~/.aws/credentials
[vac-4h]
credential_process = $(which vac) get --ttl 4h
[vac-no-cache]
credential_process = $(which vac) get -f
EOF

~$ vac status
+----------------+---------------------+
|  LOCAL STATE   |                     |
+----------------+---------------------+
| Current Engine | dev                 |
| Current Role   | admin               |
+----------------+---------------------+
+-----------+--------+---------------+
|  ENGINE   |  ROLE  |  EXPIRATION   |
+-----------+--------+---------------+
| dev       | admin  | in 2 hours    |
| prod      | admin  | 2 days ago    |
| staging   | admin  | 2 days ago    |
+-----------+--------+---------------+
+-------------+--------------------------------------+
|    VAULT    |                                      |
+-------------+--------------------------------------+
| ClusterID   | 0e6b2fcd-e84b-a7cd-f84d-6b31947a8d73 |
| ClusterName | vault-cluster-90f72c95               |
| Initialized | true                                 |
| Sealed      | false                                |
| Version     | 1.5.3                                |
+-------------+--------------------------------------+

# List available AWS engines
path "sys/mounts" {
  capabilities = ["read"]
}

# List all the roles for each <engine_path>
# path "<engine_path>/roles" {
#  capabilities = ["list"]
# }
# eg:
path "dev/roles" {
 capabilities = ["list"]
}

path "staging/roles" {
 capabilities = ["list"]
}

# Assume the role
# path "<engine_path>/sts/<role>" {
#  capabilities = ["update"]
# }
# eg:

path "dev/sts/admin" {
  capabilities = ["update"]
}

path "staging/sts/admin" {
  capabilities = ["update"]
}