AWS Secrets Manager and the principle of least-privilege

#!/bin/bash

#########################################################################################################
# Bash script to create temporary session tokens with MFA for AWS KMS.                                  #
#                                                                                                       #
# After running this script, ~/.aws/config and ~/.aws/credentials are updated automatically containing  #
# the newly created session tokens and configs.                                                         #
# Source: https://aws.amazon.com/premiumsupport/knowledge-center/authenticate-mfa-cli/                  #
#                                                                                                       #
# Requirements:                                                                                         #
#   aws-cli:                                                                                            #
#     See: https://docs.aws.amazon.com/cli/latest/userguide/getting-started-install.html                #
#   jq:                                                                                                 #
#     $ sudo apt-get install jq     # linux                                                             #
#     $ brew install jq             # macOs                                                             #
#                                                                                                       #
# Usage:                                                                                                #
#   $ aws_mfa.sh -u  -m                                                             #
#                                                                                                       #
#########################################################################################################

# Exit immediately if there's an error.
set -e

# Constants.
AWS_CREDENTIAL_KEYS=("aws_access_key_id" "aws_secret_access_key" "aws_session_token")
PROFILE_NAME="mfa"
CONFIG_REGION_KEY="region"
CONFIG_REGION_VALUE="eu-west-1"


# Parameters.
username=""
mfa_code=""

# Help menu.
function help() {
    echo "Initializes AWS KMS with a temporary session token using MFA."
    echo "Usage: aws_mfa.sh -u  -m "
    echo ""
    echo "Options:"
    echo "  -h    Prints the help menu."
    echo "  -u    Sets the username [required]."
    echo "  -m    Sets the MFA code [required]."
}

# Read arguments.
while getopts "hu:m:" opt; do
    case ${opt} in
        h)
            help
            ;;
        u)
            username=$OPTARG
            ;;
        m)
            mfa_code=$OPTARG
            ;;
        \?)
            help
            ;;
    esac
done

# Check username and MFA code.
if [ -z "$username" ]
then
    echo "Missing username, please provide a valid username with -u."
    exit 64
fi
if [ -z "$mfa_code" ]
then
    echo "Missing MFA code, please provide a valid MFA code with -m."
    exit 64
fi


# Get serial number for the user.
mfa_arn=$(aws iam list-virtual-mfa-devices | jq -c ".VirtualMFADevices[] | select(.User.UserName == \"$username\") | .SerialNumber" | tr -d '"')
if [ -z "$mfa_arn" ]
then
    echo "User not found: ${username}, could not init AWS."
else
    echo "Obtained MFA ARN"
fi

# Update credentials: detele existing session token and add new one under given profile.
echo "Updating ~/.aws/credentials"
aws_credential_values=($(aws sts get-session-token --serial-number ${mfa_arn} --token-code ${mfa_code} | jq -c ".Credentials.AccessKeyId, .Credentials.SecretAccessKey, .Credentials.SessionToken" | tr -d '"'))
for i in "${!aws_credential_values[@]}"; do
    aws configure set --profile ${PROFILE_NAME} ${AWS_CREDENTIAL_KEYS[$i]} ${aws_credential_values[$i]}
done

# Update config.
echo "Updating ~/.aws/config"
aws configure set --profile ${PROFILE_NAME} ${CONFIG_REGION_KEY} ${CONFIG_REGION_VALUE}