{"action":"created","issue":{"url":"https://api.github.com/repos/aws/aws-sdk-go/issues/841","repository_url":"https://api.github.com/repos/aws/aws-sdk-go","labels_url":"https://api.github.com/repos/aws/aws-sdk-go/issues/841/labels{/name}","comments_url":"https://api.github.com/repos/aws/aws-sdk-go/issues/841/comments","events_url":"https://api.github.com/repos/aws/aws-sdk-go/issues/841/events","html_url":"https://github.com/aws/aws-sdk-go/pull/841","id":177570961,"number":841,"title":"Read awscli/botocore credentials cache if available","user":{"login":"pwaller","id":438648,"avatar_url":"https://avatars.githubusercontent.com/u/438648?v=3","gravatar_id":"","url":"https://api.github.com/users/pwaller","html_url":"https://github.com/pwaller","followers_url":"https://api.github.com/users/pwaller/followers","following_url":"https://api.github.com/users/pwaller/following{/other_user}","gists_url":"https://api.github.com/users/pwaller/gists{/gist_id}","starred_url":"https://api.github.com/users/pwaller/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/pwaller/subscriptions","organizations_url":"https://api.github.com/users/pwaller/orgs","repos_url":"https://api.github.com/users/pwaller/repos","events_url":"https://api.github.com/users/pwaller/events{/privacy}","received_events_url":"https://api.github.com/users/pwaller/received_events","type":"User","site_admin":false},"labels":[],"state":"closed","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":4,"created_at":"2016-09-17T11:34:14Z","updated_at":"2016-09-19T17:34:49Z","closed_at":"2016-09-19T17:34:49Z","pull_request":{"url":"https://api.github.com/repos/aws/aws-sdk-go/pulls/841","html_url":"https://github.com/aws/aws-sdk-go/pull/841","diff_url":"https://github.com/aws/aws-sdk-go/pull/841.diff","patch_url":"https://github.com/aws/aws-sdk-go/pull/841.patch"},"body":"Before this PR, it is not possible to use profiles which assume roles requiring MFA.\r\n\r\nAfter this PR, it is possible so long as you first populate the AWS cli\r\ncredential cache, by running an awscli command which asks for the MFA token.\r\n\r\nGiven a profile of the form:\r\n\r\n```\r\n[default]\r\naws_access_key_id=FOO\r\naws_secret_access_key=BAR\r\n\r\n[profile other-role]\r\nrole_arn = arn:aws:iam::000000000001:role/other-role\r\nsource_profile = default\r\nmfa_serial = GAHP01234567\r\nexternal_id = 123456789012\r\n```\r\n\r\n`aws-sdk-go` currently cannot function with `AWS_PROFILE=other-role`.\r\n\r\nThis PR enables this functionality without implementing MFA,\r\nby taking advantage of the credentials cache maintained by awscli.\r\n\r\nI submit this as a proof of concept to test the waters. Feedback welcome.\r\n\r\nThe next step would be to implement a method to request a MFA token from\r\nthe user, but this minimal implementation allows me to start being\r\nproductive using the aws-sdk-go toolkit.\r\n\r\nIt feels ugly to refer to the `~/.aws/cli/cache` directory, but I don't\r\nknow what else you might do, it seems desirable to share these\r\ncredentials with awscli/botocore."},"comment":{"url":"https://api.github.com/repos/aws/aws-sdk-go/issues/comments/248063021","html_url":"https://github.com/aws/aws-sdk-go/pull/841#issuecomment-248063021","issue_url":"https://api.github.com/repos/aws/aws-sdk-go/issues/841","id":248063021,"user":{"login":"pwaller","id":438648,"avatar_url":"https://avatars.githubusercontent.com/u/438648?v=3","gravatar_id":"","url":"https://api.github.com/users/pwaller","html_url":"https://github.com/pwaller","followers_url":"https://api.github.com/users/pwaller/followers","following_url":"https://api.github.com/users/pwaller/following{/other_user}","gists_url":"https://api.github.com/users/pwaller/gists{/gist_id}","starred_url":"https://api.github.com/users/pwaller/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/pwaller/subscriptions","organizations_url":"https://api.github.com/users/pwaller/orgs","repos_url":"https://api.github.com/users/pwaller/repos","events_url":"https://api.github.com/users/pwaller/events{/privacy}","received_events_url":"https://api.github.com/users/pwaller/received_events","type":"User","site_admin":false},"created_at":"2016-09-19T17:34:49Z","updated_at":"2016-09-19T17:34:49Z","body":":+1:. This makes total sense to me, even more so after having used this in anger a bit."}}
{"actor":{"display_login":"pwaller"}}