Improvements on Launching Sessions with Custom Commands

[sheldonhull]

@osterman had a great discussion with me during SweetOps session today.
Proposed some great concepts about having Leapp launch a custom command based on the active profile.

For example, Cloudposse uses a tool called geodesic and would like to launch the docker session using the credentials from Leapp.

Erik has a vibrant online community with 3000+ members doing Development and Operational work, so I'd definitely recommend engaging in the sweetops slack community as well as considering some feedback from them.

We did a review on this during today's SweetOps office hours, so checkout the Youtube recap for Jun 2 if you want to listen in on the discussion.

[osterman]

Leapp seems to solve a pain point we've had with our customers. We've hobbled along with aws-vault and saml2aws (which we run from within geodesic), but those tools leave a lot to be desired from a developer perspective. So if the launch command could be customized, I see Leapp as a great tool.

In the animation, it shows how the user is dropped to a shell with an authenticated session. This is rad. Now all we want is to customize that command so instead of running something like bash we can instead run a command like docker run -it cloudposse/geodesic:latest-debian (try that!)

[jgrumboe]

@osterman
Sorry, what do you mean by launch command? I'm not automatically "dropped" into a bash. I have iTerm open and magic happens behind the scenes in .aws/credentials.
Are you talking about a new feature or an existing one?
Thanks, Jo

[andreacavagna01]

you are right @jgrumboe, Leapp manages the ~/.aws/credentials file, and because any CLI and SDK will look at that file for AWS credentials, that makes Leapp fully compatible with any IDE, Terminal, and SDK :)

[Nuru]

I need routine access to multiple AWS organizations. For me to be interested in using Leapp it would have to support multiple AWS SSOs (#63), multiple federated providers, Okta, and provide transparent support for other apps like Docker via ecr-login and Lens via Kubernetes external authorization providers such as aws eks get-token. It would also have to support configuration via multiple AWS_CONFIG_FILE files and automatically import roles from them. And I would needs some way to hierarchically manage organizations, accounts, and profiles (I have access to over 1,000 profiles). How much of that is on the Roadmap?

[sheldonhull]

You have high standards. I was happy with my simple aws-vault replacement 😆

[andreacavagna01]

Thanks, @sheldonhull, for introducing Leapp at the SweetOps Session!

The idea of launching a custom command (a "Macro" or a sort of "recipe") from single or multiple Session credentials is something we have already talked about internally.

• We want to generalize also the SSM method to make contributors create their own "Actions" that can run on one or multiple Sessions with a custom macro (in this case, the docker run method).

I think AWS SSM Session is the starting point to generalize the idea of this action to make this kind of thing work!

I'll keep you also updated on that thing, this is not in the close Roadmap, but indeed something we want to add in Leapp.

From this point of view, another Action is the ability to work with your docker container docker run -it cloudposse/geodesic:latest-debian.

• Leapp, by default, manages the ~/.aws/credentials file by generating short-lived plain credentials only, so if geodesic accepts an access token and secret token from that file, that made it fully compatible by default with geodesic.

• Multiple AWS SSO is inside the MVP Roadmap and has been [already requested](Multiple AWS SSO Support #63). After the next release, which includes a major code refactoring, all this support will be easier to implement. I'll keep you update on this specific feature.

• Multiple federated providers are supported by now. If you mean AWS Federated Sessions, you can have more than one federated Session with different Identity Providers (GSuite, Okta, and OneLogin are supported by now). Leapp will provide more Identity Providers with the community's help.
  To implement it, it is only a single callback in a method to retrieve the SAML Assertion. This feature is for sure in Roadmap.

• Also, in Roadmap, we have to manage Sessions hierarchically to divide them by organization, team or project, or whatever.
  Grouping is more a UX/UI feature than a development feature, and we are trying to figure out the best way to implement this thing visually.

• Lastly, the support configuration via multiple AWS_CONFIG_FILE files and the auto-import of role from them is not in Roadmap but has been discussed by the community. I would have more feedback from the community, at least before adding it to the Roadmap.

Thanks for all your suggestion, hope I've cleared more the Roadmap of the project, let me know if you need any help