tower-cli
tower-cli copied to clipboard
Automatically use cloud native credentials where appropriate
The current behaviour requires that cloud creadentials i.e. --access-key
and --secret-key
need to be provided manually at the moment as highlighted in the help below:
$ tw credentials create aws --help
Usage: tw credentials create aws [OPTIONS]
Create new AWS workspace credentials
Options:
* -n, --name=<name> Credentials name
-a, --access-key=<accessKey> The AWS access key required to access the desired service
-s, --secret-key=<secretKey> The AWS secret key required to access the desired service
-r, --assume-role-arn=<assumeRoleArn> The IAM role to access the AWS resources. It should be a fully qualified AWS role ARN.
-h, --help Show this help message and exit.
-V, --version Print version information and exit.
Would it be possible to check if these credentials already exist in the standard location ~/.aws/credentials
and use a named profile defined in that file instead of manually specifying them?
So what I am thinking is that you can skip the tw credentials create aws
step if you have a ~/.aws/credentials
and use that instead for tw credentials list
.
Some pseudo-docs for this would read as:
If you have already defined credentials in `~/.aws/credentials` then these will be loaded automatically.
You can check if these have been found as expected by running `tw credentials list`.
Alternatively, you can manually create the credentials using `tw credentials create aws` as outlined below:
This is what ~/.aws/credentials
looks like and so credentials with --name=boss
and --name=jesus
will be available to downstream tw
commands.
$ cat ~/.aws/credentials
[boss]
aws_access_key_id = XXXXXXXXXXXXXXXXXXXX
aws_secret_access_key = XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
[jesus]
aws_access_key_id = XXXXXXXXXXXXXXXXXXXX
aws_secret_access_key = XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
As a result of this, and in general it may also make sense to change tw credentials create aws
-> tw credentials add aws
as suggested by @pditommaso because we won't always need to create credentials. Will create a separate issue for this.