POC: Single Sign-On

package.json

@@ -4,6 +4,8 @@
     "sls-dev-tools": "./lib/index.js"
   },
   "dependencies": {
+    "@aws-sdk/client-sts": "^3.32.0",
+    "@aws-sdk/credential-provider-node": "^3.32.0",
     "aws-sdk": "^2.655.0",
     "blessed": "^0.1.81",
     "blessed-contrib": "^4.8.17",

src/CLIMain.js

@@ -194,10 +194,9 @@ class Main {
       this.screen
     );
 
-    return creds
-      .getPromise()
-      .then(() => {
-        AWS.config.credentials = creds;
+    return creds()
+      .then((credentials) => {
+        AWS.config.credentials = credentials;
         this.updateAWSServices();
 
         if (
@@ -213,7 +212,11 @@ class Main {
         }
       })
       .catch((error) => {
-        console.error(error);
+        console.error(
+          `Credentials Error ${
+            process.env.AWS_PROFILE || this.program.profile
+          } \n${error.message}\n${error.stack}`
+        );
       });
   }
 

src/services/awsCredentials.js

@@ -1,7 +1,27 @@
-import AWS from "aws-sdk";
-
+import { defaultProvider } from "@aws-sdk/credential-provider-node";
+import { AssumeRoleCommand, STSClient } from "@aws-sdk/client-sts";
 import { promptMfaModal } from "../modals";
 
+async function RoleAssumer(sourceCredentials, params) {
+  const client = new STSClient({
+    credentials: sourceCredentials,
+  });
+
+  const command = new AssumeRoleCommand(params);
+
+  try {
+    const response = await client.send(command);
+    return {
+      expiration: response.Credentials.Expiration,
+      accessKeyId: response.Credentials.AccessKeyId,
+      secretAccessKey: response.Credentials.SecretAccessKey,
+      sessionToken: response.Credentials.SessionToken,
+    };
+  } catch (e) {
+    console.error("Failed to assume role", e);
+  }
+}
+
 function getAWSCredentials(profile, program, screen) {
   // Define tokenCodeFn for SharedIniFileCredentials:
   // Arguments:
@@ -22,37 +42,20 @@ function getAWSCredentials(profile, program, screen) {
       );
   }
 
-  if (profile) {
-    process.env.AWS_SDK_LOAD_CONFIG = 1;
-    return new AWS.SharedIniFileCredentials({
-      profile,
-      tokenCodeFn: mfaCodeFn,
-      callback: (err) => {
-        if (err) {
-          console.error(`SharedIniFileCreds Error: ${err}`);
-        }
-      },
-    });
-  }
-  if (process.env.AWS_ACCESS_KEY_ID && process.env.AWS_SECRET_ACCESS_KEY) {
-    return new AWS.Credentials({
-      accessKeyId: process.env.AWS_ACCESS_KEY_ID,
-      secretAccessKey: process.env.AWS_SECRET_ACCESS_KEY,
-      sessionToken: process.env.AWS_SESSION_TOKEN,
-    });
-  }
-  if (process.env.AWS_PROFILE) {
-    return new AWS.SharedIniFileCredentials({
-      profile: process.env.AWS_PROFILE,
-      tokenCodeFn: mfaCodeFn,
-      callback: (err) => {
-        if (err) {
-          console.error(`SharedIniFileCreds Error: ${err}`);
-        }
-      },
-    });
-  }
-  return new AWS.SharedIniFileCredentials({ profile: "default" });
+  // https://docs.aws.amazon.com/AWSJavaScriptSDK/v3/latest/modules/_aws_sdk_credential_provider_node.html
+  //
+  // It will attempt to find credentials from the following sources (listed in order of precedence):
+  //
+  // Environment variables exposed via process.env
+  // SSO credentials from token cache
+  // Web identity token credentials
+  // Shared credentials and config ini files
+  // The EC2/ECS Instance Metadata Service
+  return defaultProvider({
+    profile,
+    mfaCodeProvider: mfaCodeFn,
+    roleAssumer: RoleAssumer,
+  });
 }
 
 module.exports = {