Merge pull request #17 from moritzheiber/master

Use MFA session for key rotation
sam701 · Feb 9, 2017 · 45a8275 · 45a8275
2 parents e6e4761 + 61e85b0
commit 45a8275
Show file tree

Hide file tree

Showing 2 changed files with 8 additions and 10 deletions.
diff --git a/assume.go b/assume.go
@@ -49,23 +49,21 @@ func assumeRole(account, role string) {
 
 	err := tryToAssumeRole(account, role)
 	if err != nil {
-		needToBeRotatedChan := make(chan bool)
-		go isNeedRotateKey(needToBeRotatedChan)
 
 		getMainAccountMfaSessionToken()
 		err = tryToAssumeRole(account, role)
 		if err != nil {
 			log.Fatalln(err)
 		}
 
-		if <-needToBeRotatedChan {
-			rotateMainAccountKey()
+		if needRotateKey() {
+			rotateMainAccountKey(iam.New(sess.New(config.Current.Profiles.MainAccountMfaSession)))
 		}
 	}
 }
 
-func isNeedRotateKey(needToBeRotated chan<- bool) {
-	session := sess.New(config.Current.Profiles.MainAccount)
+func needRotateKey() bool {
+	session := sess.New(config.Current.Profiles.MainAccountMfaSession)
 	cl := iam.New(session)
 
 	keyId := cred.GetMainAccountKeyId(config.Current.Profiles.MainAccount)
@@ -85,7 +83,7 @@ func isNeedRotateKey(needToBeRotated chan<- bool) {
 		log.Fatalln("Cannot get creation time for key", keyId)
 	}
 
-	needToBeRotated <- int(time.Now().Sub(creationTime).Minutes()) >= config.Current.KeyRotationIntervalMinutes
+	return int(time.Now().Sub(creationTime).Minutes()) >= config.Current.KeyRotationIntervalMinutes
 }
 
 func adjustAccountName(account string) string {

diff --git a/rotate_key.go b/rotate_key.go
@@ -14,12 +14,12 @@ import (
 )
 
 func rotateMainAccountKeyAction(*cli.Context) error {
-	rotateMainAccountKey()
+	client := iam.New(sess.New(config.Current.Profiles.MainAccount))
+	rotateMainAccountKey(client)
 	return nil
 }
 
-func rotateMainAccountKey() {
-	client := iam.New(sess.New(config.Current.Profiles.MainAccount))
+func rotateMainAccountKey(client *iam.IAM) {
 	key, err := client.CreateAccessKey(&iam.CreateAccessKeyInput{
 		UserName: aws.String(getUserName()),
 	})