Hacker Newsnew | past | comments | ask | show | jobs | submit | simzor's commentslogin

Makes operating AWS CLI against a user with MFA enabled easier

---------

#!/bin/sh

echo "Store and retrieve session token AWS STS \n\n"

# Get source profile read -p "Source Profile [<profile_name>]: " source_profile source_profile=${source_profile:-'<profile_name>'} echo $source_profile

# Get destination profile read -p "Destination Profile [<profile_name>-mfa]: " destination_profile destination_profile=${destination_profile:-'<profile_name>-mfa'} echo $destination_profile

mfa_serial_number='arn:aws:iam::<id>:mfa/<name>'

echo "\nOTP: " read -p "One Time Password (OTP): " otp

echo "\nOTP:" $otp echo "\n"

output=$(aws sts get-session-token --profile <profile_name> --serial-number $mfa_serial_number --output json --token-code $otp)

echo $output

access_key_id=$(echo $output | jq .Credentials.AccessKeyId | tr -d '"') secret_access_key=$(echo $output | jq .Credentials.SecretAccessKey | tr -d '"') session_token=$(echo $output | jq .Credentials.SessionToken | tr -d '"')

aws configure set aws_access_key_id $access_key_id --profile=$destination_profile aws configure set aws_secret_access_key $secret_access_key --profile=$destination_profile aws configure set aws_session_token $session_token --profile=$destination_profile

echo "Configured AWS for profile" $destination_profile


maybe look into AWS Vault?


Thank you!!


Haha. To be fair GitHub has had a lot of issues that last few months though.


You're not wrong about this... [0] https://news.ycombinator.com/item?id=28130251

Just don't go 'all in' on one service without backups or some second plan.


Is the server down due to HN traffic? :P


When I first started working from home because of the pandemic, I had a IKEA Marcus chair, however, this soon was too bad of a chair to sit all day in, so I ended up investing in a Herman Miller Embody, and have not been looking back since. Great chair!


First thing that came to mind is that you should set a max width of the content container. For those of us that have a ultrawide for example, it can become hard to read when the content spans the entire screen.


Thank you for the feedback... I appreciate you taking time to provide some simple thoughts.


This reminds me that we should get ChaosMonkey up and running. :D


Now imagining a literal chaos monkey running around a datacenter with a blowtorch, setting random racks on fire


That's a concept for a startup, sell drones/robots that randomly put racks on fire.


I like that idea :D


Are they also having issues with Webhooks and/or pushes? Had some slowdowns for pushes, and webhooks does not seem to be triggering.


This looks great. Is there something similar that supports PHP?


This can. Just rig the AST in. I'm going to try a prototype.


Hate the idea to be honest. In my opinion this will just bloat the language, no need. Rather avoid the hundreds of different standards like PHP.


As Zoom now owns Keybase, I am really worried about the future of Keybase, especially after statements like these.

This also makes none or very little sense - if this is actually just to cooperate with law enforcement, why would encrypting corporate (or paying) calls be any better, the bad people that are referred to in the statement could just get a paid plan?


Keybase is dead. In the PR they were explicit they were hired to work on Zoom and not continue working on Keybase. Luckily there is keys.pub


Is keybase fully open source? Or is the server closed source?


The server stills closed but seems there're people saying the server-side is not needed(!) to trust the platform.

https://www.reddit.com/r/Keybase/comments/77c241/keybase_why...


Why (!)?

Of course servers are untrusted. If you think you need to see the server source then any trust you have is mistaken.

Same as with HTTPS. If you think you need to trust the MITM, you've already lost


I think you don't need to trust the server just if you can audit the frontend and assure it does not share any sensitive information with the server-side. If they apply the concept of data minimisation, decentralisation and distribution properly, there are fewer risks involved.

But, if the server manages sensitive information, yes. It is preferable to audit the server code to understand how they handle the lifecycle of the information.

"If you think you need to see the server source then any trust you have is mistaken."

Sorry but I don't agree. I trust in systems I can verify. Trust without verifying is not trust, it is faith.


OK, but that doesn't help you when they shut down the server, which I think is what this thread was about? That zoom purchased it as an aquihire to have staff work on zoom, and isn't committed to the platform.


Agreed, but a server turned off has lower risks to leak information. And I think also they bought the expertise of the team to improve zoom, more than getting the solution per se. It will take some months to have this question answered (about what will really happen to keybase)


Clearly, a product which has been discontinued has less of a chance of violating your privacy, that's true.... I think there are a couple different non-intersecting conversations going on here...


But was it discontinued?

I was looking into their terms (https://keybase.io/docs/terms) and they should notify before it. And seems my account is up over there.


Paying leaves a verified trace though.


True, but they can't know the content at all.


-No worries, they'll just assume the content is malicious, then. (/s. I hope.)


It sounds like bullshit. I don't think the reason to avoid keybase is necessarily because it draws their security from authorities into question, but it does call into question if a company that would say something that looks like impulsive nonsense is someone you want to trust.


Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: