Interactive AWS CLI Query Filtering with JSONPath

Since I seem to be on a kick posting AWS articles, here’s one more!

Rather than using shell shenanigans (`grep`, `awk`, `sed`, and friends) to filter AWS CLI output from `text` output type, the integrated JMESPath query command makes it easy to filter the output before `aws` command even spits it out. However, a JMESPath query can become pretty complex when using it to dig some information deep in the output structure. Of course, while a query can be complex, digging the same information out with a string of piped `greps`, `seds`, and `awks` is even more messy, not to mention fragile.

A very handy trick exists that makes building JMESPath queries a lot easier! This technique can be used for ad hoc queries when you simply need to find some information from a large output, but it can just as well be used as a testing ground for a query to be embedded in a script. Here’s how it works (assuming you’re on some kind of *nix command line… macOS, Ubuntu, something; though it may even work in Windows command prompt since it’s Python based). First, install `jmespath-terminal`:

sudo pip install jmespath-terminal

Now (with `aws` CLI obviously configured), retrieve the unfiltered output from which you wish to dig the important nuggets of information. Here I’m listing all the security groups. Note that the output format needs to be set to `json` (if you have configured output format to something else (i.e. `table` or `text`) in `~/.aws/config`, here `–output json` will override it (on the other hand, `json` is the default output format if you haven’t set it otherwise). Save the output into a file. Then launch `jpterm` with the file name as the sole argument.

aws ec2 describe-security-groups --output json > ~/securitygroups.json
jpterm ~/securitygroups.json

And…

jmespath

Now you’ll have an interactive text-based console, where you can experiment with JMESPath queries! In the left pane is your original data, while on the right you’ll see the result of the JMESpath query immediately as you type!

Check out the official JMESPath Specification for everything you can do with the embedded JMESPath queries. And while you’re reading, also check out James Lawson’s 2015 article on JMESPath queries in the AWS CLI for more insights.

One more thing. I mentioned above that you must use `–output json` to get the output in a format that `jsonpath-terminal` can understand. That is accurate, but if you’re building the JMESPath query for a script, once you’re satisfied with the query, you can switch the output format to `–output text`, and AWS will use the query just fine, while the final output will be in `text` format (i.e. no quotes around a string, no JSON artifacts). This can be useful especially if the final output result set is very small, such as a single value, or a simple list of IDs, as such output may then be easier to process further with your favorite shell commands.

Easy MFA and Profile Switching in AWS CLI

UPDATE 2019-01-15: I have released a much-improved v2.0 of the awscli-mfa.sh script. Its location has also changed; it can now be found at https://github.com/vwal/awscli-mfa

An updated blog entry is forthcoming; the article below discusses version 1.0 which was completely rewritten in this new iteration.

As I alluded in the previous post, I have released another AWS script that works in conjunction with the AWS CLI Key Rotation script. This one is for easily activating an MFA session while on the command line. It also makes it easy to switch between the different configured AWS profiles.

While MFA is perhaps more frequently used with the web console sessions, in some ways the API keys are even more of a security risk. Whereas people usually memorize the console password, or keep it in a password manager, the API keys sit in plaintext in `~/.aws/credentials` file. All it takes is a malware that dumps the content of that known file location to a hacker, or perhaps a stolen laptop, or a stolen unencrypted flash drive (that you used to transfer the API keys to your new laptop, say), and a third party will have access to as much of your AWS assets as the IAM policy associated with the key allows. Admin keys? Full access! For this reason, I advocate the use of MFA especially for the keys with wide access, and that are intended for interactive use. Of course roles should be used as much as possible, and as much as possible should be automated, but still, in most environments people use the API keys for various command line tasks and to run utility scripts from the admins’ laptops.

Enter awscli-mfa.sh! This script makes it easy to select a profile that has MFA configured, to initialize an MFA session, and to make the MFA session default for the current console session (via an environment variable). The script is obviously interactive since it’ll prompt for an MFA one-time passcode. When you run it, it’ll query the AWS profiles configured in `~/.aws/credentials`, and list them out, along with the actual IAM username associated with each profile (since the profile names are arbitrary, and as such can be set to anything). The script will also indicate whether a virtual MFA has been configured for the profile. You can select to activate a profile that doesn’t have MFA configured, but obviously then an MFA code is not prompted for, and MFA is not used. When the chosen profile does have MFA configured, the script will prompt for the one-time passcode (e.g. from Authy or Google Authenticator), initialize the session, and output the environment export variable for easy cut-and-paste to the console (when ran on a Mac, or in a Linux GUI that has `xclip` installed, the export string is automatically copied on the clipboard). Paste on the command line, hit Enter, and the MFA profile is active!

Once an MFA session has been activated and you run the script again, you’ll see the newly initialized MFA profile under its base profile. You can switch away from it to another profile, and then back again. The MFA profile is indicated either in “OK” or “LIMITED” status. The latter may suggest that the IAM policy session duration has been set to a shorter period than what was configured in this script (you can adjust the token lifetime duration in the script on line 16. It should be set to match the session duration set in the MFA enforcement policy (if the policy duration times out first, the key appears still valid, but it’s no longer authorized for any transaction on the AWS). Note that if the IAM policy for the profile is limited so that it isn’t allowed to query `aws iam get-user` for itself, you’ll see the “LIMITED” status even when the MFA session is valid. Once the session token expires, the MFA profile disappears from the session list (even though you can see it still if you `cat ~/.aws/credentials` file.

A good write-up and an example MFA enforcement policy can be found here. I used their policy with a slight modification: I set the maximum MFA session duration to six hours by altering the Condition for the last two Sids in the policy, like so:

"Condition": {
  "NumericGreaterThanIfExists": {
    "aws:MultiFactorAuthAge": "21600"
  }
}

As I mentioned in the previous post (“AWS CLI Key Rotation Script for IAM Users revisited“), you can use an MFA session initialized with this script to rotate the keys of the MFA session’s base profile that doesn’t have permissions for anything without an active associated MFA session. As long as you have an MFA session initialized for the profile whose keys you want to rotate, the key rotation script will detect the presence of the MFA session, and ask if you would like to use it to execute the key rotation for the base profile. The MFA sessions are not visible in the key rotation session list because their keys are transient, only valid for the length of an MFA session.

The script was written for macOS, but portability for Ubuntu (and so, probably most/all Linux distros) was added.

The awscli-mfa.sh script is available from its GitHub repository.

I recommend Authy for the virtual MFA (it’s available both for iOS and Android).

As always, comments or improvement suggestions are welcome (either as comments to this post, or as PRs to the repository)!

UPDATE 2018-02-19: I’ve updated the script, fixed some minor bugs for some edge cases, cleaned up its formatting, clarified the output, and added a companion script (source-to-clear-AWS-envvars.sh) that can be used to clear any AWS secrets/variables that may be set in the environment through the use of the awscli-mfa.sh script.

AWS CLI Key Rotation Script for IAM Users revisited

In April of this year I published a Bash script for rotating the default AWS API keys configured in `~/.aws/credentials` file. Now I have improved on the original script, adding the following functionality:

  • The script is now fully interactive, and supports multiple profiles. It was an interactive script before, potentially requiring user input during its run, and as such was intended for manual execution. Now the script presents a list of configured profiles from which you can choose a profile whose keys you want to rotate.
  • The script works with Multi-Factor Authentication. At work we have been moving increasingly to MFA/2FA, and have also started enforcing MFA use from the users (this policy works great for that purpose). Since MFA enforcement for AWS console and for the CLI API cannot be separated for a given IAM user for the most part (since the console is just a GUI for the API), there had to be a solution for relatively convenient use of MFA on the command line. My second script (more detail in the next post) offers that capability, and now the key rotation script is aware of it. If you’re rotating the keys for an IAM account whose MFA use is enforced, the script now detects an existing MFA profile (created by my CLI MFA script), and can use it to authorize key rotation for the base profile, which might otherwise not be authorized to execute the key rotation operation.
  • The listing of the configured profiles includes the current keys (two concurrent keys is the recommended maximum by policy), the ages of the keys, the actual IAM username (since the profile name is arbitrary, and as such can be set to anything), and the access status of the profile (‘OK’, or ‘LIMITED’; the latter is displayed when the profile doesn’t appear to have normal access during the query process — for example, it may result from MFA enforcement)
  • Many AWS errors are also masked and translated to more user-friendly outputs. If a profile doesn’t have a valid key, the script handles it gracefully and displays: “CHECK CREDENTIALS!” next to that profile (and obviously it cannot give more detail about such profile, or offer the option to rotate its keys).
  • The script was originally written for macOS, but it has now been tested on Ubuntu, and portability has been added (hence it likely works on other Linux distros as well).

The latest version of the aws-iam-rotate-keys.sh script is available from the same repository as before.