diff --git a/README.md b/README.md index 5cf0265..b20f9d8 100644 --- a/README.md +++ b/README.md @@ -29,6 +29,10 @@ $ pip install --user awscli-plugin-yubikeytotp To enable the plugin, add this to your `~/.aws/config`: ``` [plugins] +# The next line is required if you are using CLI v2 +# Use the path that `pip` installed the package to - this one is in user mode +cli_legacy_plugin_path = /home/myhomefolder/.local/lib/python3.8/site-packages/ + yubikeytotp = awscli_plugin_yubikeytotp ``` Also make sure to have your MFA ARN configured for your profile: @@ -37,6 +41,8 @@ Also make sure to have your MFA ARN configured for your profile: role_arn = arn:aws:iam::... mfa_serial = arn:aws:iam::... source_profile = default +# You can also override the key name (useful if you used a "friendly" key name for when you're using the console) +mfa_alias = shinykey ``` diff --git a/awscli_plugin_yubikeytotp/prompter.py b/awscli_plugin_yubikeytotp/prompter.py index 8d4251a..a1868cd 100644 --- a/awscli_plugin_yubikeytotp/prompter.py +++ b/awscli_plugin_yubikeytotp/prompter.py @@ -26,8 +26,9 @@ def _unix_console_print(s): class YubikeyTotpPrompter(object): - def __init__(self, mfa_serial, original_prompter=None): + def __init__(self, mfa_serial, mfa_alias, original_prompter=None): self.mfa_serial = mfa_serial + self.mfa_alias = mfa_alias self._original_prompter = original_prompter def __call__(self, prompt): @@ -36,13 +37,13 @@ def __call__(self, prompt): ["ykman", "oath", "list"], capture_output=True, check=True ) available_keys = available_keys_result.stdout.decode("utf-8").split() - available_keys.index(self.mfa_serial) + available_keys.index(self.mfa_alias) console_print( "Generating OATH code on YubiKey. You may have to touch your YubiKey to proceed..." ) ykman_result = subprocess.run( - ["ykman", "oath", "code", "-s", self.mfa_serial], capture_output=True + ["ykman", "oath", "code", "-s", self.mfa_alias], capture_output=True ) console_print("Successfully created OATH code.") token = ykman_result.stdout.decode("utf-8").strip() @@ -69,12 +70,15 @@ def inject_yubikey_totp_prompter(session, **kwargs): config = session.get_scoped_config() mfa_serial = config.get("mfa_serial") + mfa_alias = config.get("mfa_alias") if mfa_serial is None: # no MFA, so don't interfere with regular flow return + if mfa_alias is None: + mfa_alias = mfa_serial assume_role_provider = providers.get_provider("assume-role") original_prompter = assume_role_provider._prompter assume_role_provider._prompter = YubikeyTotpPrompter( - mfa_serial, original_prompter=original_prompter + mfa_serial, mfa_alias, original_prompter=original_prompter )