Vagrant, AWS and temporary security credentials

Vagrant, AWS and temporary security credentials

Photo by Liam Tucker on Unsplash

Vagrant is a great tool for spinning up test and dev infrastructure.

We’ve recently hit issues with vagrant-aws due to our use of Google as a SAML source for authentication for a main account and then assumed roles across all of our other AWS accounts. Vagrant doesn’t seem to understand the concept of switching roles via another and configuration profiles don’t seem to help with that.

All of our roles are prefixed sso- which makes them nice and easy to regexp out of things. Here’s our first attempt at using a bash script to achieve this:

role=$(aws --profile google sts get-caller-identity | jq .Arn | sed -E 's|.*(sso-.*)/.*|\1|')

content=$(aws --profile google sts assume-role --region eu-west-2 --role-arn arn:aws:iam::xxxxxxxxxx:role/${role} --role-session-name Vagrant)
key_id=$(jq -r '.Credentials.AccessKeyId' <<< "${content}" )
secret_key=$(jq -r '.Credentials.SecretAccessKey' <<< "${content}" )
session_token=$(jq -r '.Credentials.SessionToken' <<< "${content}" )
export AWS_ACCESS_KEY_ID=$key_id
export AWS_SECRET_ACCESS_KEY=$secret_key
export AWS_SESSION_TOKEN=$session_token
export AWS_DEFAULT_REGION=eu-west-2

Using source in bash pulls the relevant temporary security credentials into the current shell and means that we can rely on Vagrant AWS doing the right things with that. The problem with this approach is that the session is only an hour long because we’re using a role to switch to another role (see https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_terms-and-concepts.html#iam-term-role-chaining) commonly referred to as role chaining.

After a while of working on things, the developers want to rsync changes to their running instances but keep being hit by session expiry which is a source of frustration and some amount of cursing.

The documentation for Vagrant says that Vagrantfile is just Ruby….. Can we add something to the top of our config and have it happen each time we run?

Turns out that yes, we can:

# Require the AWS SDK Gem. If this errors you need to:
# `vagrant plugin install aws-sdk`
require ‘aws-sdk’

# Use the ‘google’ SSO profile initially
client = Aws::STS::Client.new(profile: ‘google’)

# Get current role to switch to it in the other account
resp = client.get_caller_identity()
role = resp.arn.gsub(/.*(sso-.*)\/.*/, ‘\1’)

# Assume the role we need in the other account
role_credentials = Aws::AssumeRoleCredentials.new(
 client: client,
 role_arn: “arn:aws:iam::xxxxxxxxxx:role/” + role,
 role_session_name: “Vagrant”
)

# Set our envvars based on the credentials we got
credentials = role_credentials.credentials
ENV[‘AWS_ACCESS_KEY_ID’] = credentials.access_key_id
ENV[‘AWS_SECRET_ACCESS_KEY’] = credentials.secret_access_key
ENV[‘AWS_SESSION_TOKEN’] = credentials.session_token
ENV[‘AWS_DEFAULT_REGION’] = ‘eu-west-2’

After installing aws-sdk using Gem, I was stumped by the error:

$ vagrant up
Vagrant failed to initialize at a very early stage:
There was an error loading a Vagrantfile. The file being loaded
and the error message are shown below. This is usually caused by
a syntax error.
Path: Vagrantfile
Line number: 0
Message: LoadError: cannot load such file -- aws-sdk

So the gotcha to be aware of is that Vagrant holds its own Gem directory, so the module needs installing via the Vagrant command:

vagrant plugin install aws-sdk

Then we’re able to get a set of temporary security credentials each and every time we run Vagrant, hopefully meaning we don’t need to worry about session timeouts again.