Programmatic way to update AWS credentials?

[dmarkey]

Hey,

Thanks for the fantastic project.

I use AWS Bedrock with an assumed role with temporary credentials.. I'd like a way to update the Roo configured credentials from the CLI so I don't have to cut and paste the 3 required credentials, thanks!

David

[dwin]

This can already be done using tools like Leapp which update your .aws/credentials file with the temporary credentials and a named profile. You then set Roo to use the named profile.

[dmarkey]

Great! Here's some AI slop for the job, and worked first time

import os
import argparse
import configparser
from pathlib import Path

def update_aws_credentials(profile_name):
    """
    Updates or creates an AWS profile in the credentials file using
    environment variables.
    """
    access_key_id = os.environ.get('AWS_ACCESS_KEY_ID')
    secret_access_key = os.environ.get('AWS_SECRET_ACCESS_KEY')
    session_token = os.environ.get('AWS_SESSION_TOKEN') # Optional

    if not access_key_id or not secret_access_key:
        print("Error: AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY environment variables must be set.")
        return

    credentials_path = Path.home() / '.aws' / 'credentials'
    config = configparser.ConfigParser()

    # Create the .aws directory if it doesn't exist
    credentials_path.parent.mkdir(parents=True, exist_ok=True)

    # Read existing credentials file if it exists
    if credentials_path.exists():
        config.read(credentials_path)

    # Update or add the profile section
    if not config.has_section(profile_name):
        config.add_section(profile_name)

    config.set(profile_name, 'aws_access_key_id', access_key_id)
    config.set(profile_name, 'aws_secret_access_key', secret_access_key)

    if session_token:
        config.set(profile_name, 'aws_session_token', session_token)
    elif config.has_option(profile_name, 'aws_session_token'):
        # Remove session token if it's not in the environment variables but exists in the file
        config.remove_option(profile_name, 'aws_session_token')

    # Write the updated configuration back to the file
    with open(credentials_path, 'w') as configfile:
        config.write(configfile)

    print(f"Successfully updated AWS credentials for profile: {profile_name}")
    if session_token:
        print("Session token was included.")
    else:
        print("Session token was not included or was removed.")


if __name__ == "__main__":
    parser = argparse.ArgumentParser(description='Update AWS credentials file from environment variables.')
    parser.add_argument('profile', help='The AWS profile name to update or create.')
    args = parser.parse_args()

    update_aws_credentials(args.profile)