Nushell script for granted

[abusch]

Hi, I'm a nushell user and I wanted to try out granted so I tried to port the assume wrapper script. This is what I came up with, in case it's useful to someone else:

# Save this file to `granted.nu` in your nushell config dir, then add `source granted.nu` in your config.nu
const var_names = ["AWS_ACCESS_KEY_ID", "AWS_SECRET_ACCESS_KEY", "AWS_SESSION_TOKEN", "AWS_PROFILE", "AWS_REGION", "AWS_SESSION_EXPIRATION", "GRANTED_SSO", "GRANTED_SSO_START_URL", "GRANTED_SSO_ROLE_NAME", "GRANTED_SSO_REGION", "GRANTED_SSO_ACCOUNT_ID"]

def --env --wrapped assume [...rest: string] {
  $env.GRANTED_ALIAS_CONFIGURED = "true"
  let output = (assumego $rest) |
    lines
  # First line is the command
  let command = $output | get -i 0 | default "" | split row " "
  # The rest of the output (if any) is the output of whatever command was run via --exec for instance
  let output = $output | skip 1

  let flag = $command | get 0

  match $flag {
    "GrantedOutput" => { 
      $output | str join "\n"
    },
    "GrantedAssume" => {
      for v in $var_names {
        hide-env -i $v
      }
      let values = $command | skip 1
      let vars = $var_names |
        zip $values |
        filter {|x| $x.1 != "None"} |
        reduce --fold {} {|it, acc| $acc | insert $it.0 $it.1} 
      load-env $vars
    },
    "GrantedDesume" => {
      for v in $var_names {
        hide-env -i $v
      }
    },
    _ => {
      # most likely no output, so nothing to do
    }
  }
}

[abusch]

I've updated it to support the latest --exec changes, if anyone is interested: https://gist.github.com/abusch/aadadfdfe4684813945daed7a4a052d6

[FollowTheProcess]

This doesn't work when you don't enter a role i.e just run assume and use the interactive picker. However I've made some tweaks to a local copy and it seems to work well:

  # Run assumego and collect its output
  let output = with-env {GRANTED_ALIAS_CONFIGURED: "true"} {
    assumego ...$args
  }

  let granted_output = $output | lines
  let granted_status = $env.LAST_EXIT_CODE

Basically don't pipe it to collect, the interactive prompt is sent to stderr so we can still pick and get the GrantedAssume ... string out :)

[abusch]

Ah yeah, it looks like I did update my local script in exactly the same way you did :) I've updated the gist with what I have in case someone else stumbles upon it.

[nathannli]

thanks!

[ankurpshah]

assume <profile_name> doesn't populates $env.AWS_PROFILE variable.

[abusch]

Hmm, it does for me (on 0.106.0).

[abusch]

I did have a couple of fixes locally due to recent deprecations, so I updated the gist. Hope it helps.

[ankurpshah]

Tried latest gist version 3. It works but still not populating environment variables.
Tried script with:
assume
assume <profile_name>

And verifired environment variables in same shell for both case using:

$env | get AWS_PROFILE
$env.AWS_PROFILE

Both gives error. Means it is not populated. Am I missing anything here?

Just FYI.

aws sts get-caller-identity --profile <profile_name> command works after running assume, but I was expecting aws sts get-caller-identity should work.

[abusch]

Are any of the other environment variables set, or is it just AWS_PROFILE that's missing?

This is what's happening for me:

~
❯ $env | transpose name value | where name =~ AWS_ | select name
╭────────────╮
│ empty list │
╰────────────╯

~
❯ assume

? Please select the profile you would like to assume: Playground
[i] To assume this profile again later without needing to select it, run this command:
> assume Playground
[✔] [Playground](ap-southeast-2) session credentials will expire in 8 hours

~ on   Playground (ap-southeast-2) [7h59m58s] took 2s
❯ $env | transpose name value | where name =~ AWS_ | select name
╭───┬────────────────────────╮
│ # │          name          │
├───┼────────────────────────┤
│ 0 │ AWS_ACCESS_KEY_ID      │
│ 1 │ AWS_PROFILE            │
│ 2 │ AWS_REGION             │
│ 3 │ AWS_SECRET_ACCESS_KEY  │
│ 4 │ AWS_SESSION_EXPIRATION │
│ 5 │ AWS_SESSION_TOKEN      │
╰───┴────────────────────────╯

[ankurpshah]

Ohh for me also it is working now. For me previously assume was working from /opt/homebrew/bin/assume. For me I added /opt/homebrew/bin/assume to config.nu file. But I have to run granted assume command to run granted.nu script. How can I run directly without mentioning granted?

[abusch]

You can just drop the file in your autoload directory ($nu.user-autoload-dirs) and it'll be automatically loaded the next time you start a shell (it's ~/.config/nushell/autoload for me). You can check if it's working by doing which assume. It should say custom, not external.

[dn-jmp]

Thank you very much for this!