aws-sts-token.rego

#!/usr/bin/env rq

# rq: query data.awsststoken.token
# rq: output-format yaml

package awsststoken

import rego.v1

# METADATA
# title: aws-sts-token.rego
# authors:
#   - rinx
# related_resources:
#   - description: rq
#     ref: https://git.sr.ht/~charles/rq
# description: |
#   this is a `rq` script for getting aws session token.
#   this is just a wrapper script for `aws sts get-session-token`.
#
#   Usage:
#     ./aws-sts-token.rego --serial arn:aws:iam::xxx:xxx/xxx --otp 012345

args := rq.args()

# parse flags
# https://git.sr.ht/~charles/rq/tree/master/item/doc/script.md#accepting-cli-arguments
flags := {
	"serial": object.get({"0": args[i + 1] | args[i] == ["--serial"][_]}, "0", ""),
	"otp": object.get({"0": args[i + 1] | args[i] == ["--otp"][_]}, "0", ""),
}

token := out.stdout.Credentials if {
	cmd := ["aws", "sts", "get-session-token", "--serial-number", flags.serial, "--token-code", flags.otp]
	out := rq.run(cmd, {"stdout_spec": "json:"})

	{rq.error(sprintf("err: %s", [out.stderr])) | out.exitcode != 0}
}