Added TTY support for --exec

--exec now uses the shell script to execute commands instead of Go; this enables TTY applications to work as expected.

ExportSSOToken Configuration and --export-sso-token Flag

@cedieio has introduced the --export-sso-token flag, which exports the SSO token to ~/.aws/sso/cache. The ExportSSOToken configuration automatically exports the SSO token by default.

Change in EKS set up

The command field in your ~/.kube/config needs to be changed to assume from assumego. Follow docs here

What's Changed

• Allow access token to be exported to plain text on ~/.aws/sso/cache by @cedieio in https://github.com/common-fate/granted/pull/518
• fix(fish_alias): fix assume script path for fish alias for brew by @Mallear in https://github.com/common-fate/granted/pull/561
• support exec using shell script for TTY applications by @JoshuaWilkes in https://github.com/common-fate/granted/pull/549
• Ensure proper initialization of profiles with source_profile by @XargsUK in https://github.com/common-fate/granted/pull/559
• Do not overwrite AWS config when sync fails by @sosheskaz in https://github.com/common-fate/granted/pull/569
• 🐛 Fix SSO token lookup keys by @cedieio in https://github.com/common-fate/granted/pull/565
• 🔧 Add ExportSSOToken config by @cedieio in https://github.com/common-fate/granted/pull/566

New Contributors

• @cedieio made their first contribution in https://github.com/common-fate/granted/pull/518
• @Mallear made their first contribution in https://github.com/common-fate/granted/pull/561
• @XargsUK made their first contribution in https://github.com/common-fate/granted/pull/559

Full Changelog: https://github.com/common-fate/granted/compare/v0.20.3...v0.20.4

Generate JSON output for SSO token expiry

Run granted sso-tokens expiry --json to print the SSO token expiry in JSON. Additionally, you can use jq to filter and display only the expired tokens in JSON format: granted sso-tokens expiry --json | jq -r '[.[] | select(.is_expired == true)]'

What's Changed

• add aos (Amazon OpenSearch) to ServiceMap by @eserte in https://github.com/common-fate/granted/pull/552
• fix(firefox_dev): fix granted containers for Firefox Dev Edition by @paulhobbel in https://github.com/common-fate/granted/pull/553
• Fix for IAM in secure storage + MFA issue by @shwethaumashanker in https://github.com/common-fate/granted/pull/557
• Output-sso-expiry-in-JSON by @shwethaumashanker in https://github.com/common-fate/granted/pull/550

New Contributors

• @eserte made their first contribution in https://github.com/common-fate/granted/pull/552
• @paulhobbel made their first contribution in https://github.com/common-fate/granted/pull/553

Full Changelog: https://github.com/common-fate/granted/compare/v0.20.2...v0.20.3

What's Changed

Downgrades aws config package and dependency ini due to a performance regression causing large config files to hang

• Update ini vers by @meyerjrr in https://github.com/common-fate/granted/pull/546

Full Changelog: https://github.com/common-fate/granted/compare/v0.20.1...v0.20.2

What's Changed

• Add method to profile to fetch the correct sso region and sso start url by @JoshuaWilkes in https://github.com/common-fate/granted/pull/544
• fix assume output for setting up SSO ENV VARS by @JoshuaWilkes in https://github.com/common-fate/granted/pull/545

Full Changelog: https://github.com/common-fate/granted/compare/v0.20.0...v0.20.1

--chain flag for Inline Role Assumption

You can now use the new --chain flag to assume another role inline. This feature can be utilized in conjunction with either the --exec option or as part of a regular profile definition.

assume <base-profile> --chain arn:aws:iam::12345678912:role/aws-example --exec -- aws sts get-caller-identity

or

assume <base-profile> --chain arn:aws:iam::12345678912:role/aws-example

DefaultExportAllEnvVar config

You can now include the DefaultExportAllEnvVar=true configuration in your ~/.granted/config file. This configuration will enable the automatic export of all environment variables by default when credential_process is used.

ExportCredsToAWS config

You can also include the ExportCredsToAWS=true configuration in your ~/.granted/config file. This will enable credentials to be exported to ~/.aws/credentials by default.

What's Changed

• fix: --unset flag not unsetting AWS_DEFAULT_REGION by @Eddie023 in https://github.com/common-fate/granted/pull/526
• add skip cred process string validation option by @JoshuaWilkes in https://github.com/common-fate/granted/pull/514
• Added ExportCredsToAWS config by @shwethaumashanker in https://github.com/common-fate/granted/pull/541
• Added DefaultExportAllEnvVar config by @shwethaumashanker in https://github.com/common-fate/granted/pull/540
• fix panic: runtime error by @shwethaumashanker in https://github.com/common-fate/granted/pull/537
• fix AWS SSO polling config by @chrnorm in https://github.com/common-fate/granted/pull/535
• add --chain flag to assume another role inline by @JoshuaWilkes in https://github.com/common-fate/granted/pull/527
• Use AWS SDK to load sso-session sections enable multiple sso users by @JoshuaWilkes in https://github.com/common-fate/granted/pull/530

Full Changelog: https://github.com/common-fate/granted/compare/v0.19.2...v0.20.0

What's Changed

• revert change to validation by @JoshuaWilkes in https://github.com/common-fate/granted/pull/523
• fix chrome profiles not launching if they contain slashes + automatically rename Chrome profiles by @chrnorm in https://github.com/common-fate/granted/pull/525

Full Changelog: https://github.com/common-fate/granted/compare/v0.19.1...v0.19.2

What's Changed

• -x alias for --export-all-env-vars by @dlambda in https://github.com/common-fate/granted/pull/520
• added assume debugging by @shwethaumashanker in https://github.com/common-fate/granted/pull/513
• Fix for RegisterClient AWS region error by @shwethaumashanker in https://github.com/common-fate/granted/pull/521

New Contributors

• @dlambda made their first contribution in https://github.com/common-fate/granted/pull/520

Full Changelog: https://github.com/common-fate/granted/compare/v0.19.0...v0.19.1

Added support for Waterfox browser

Granted now supports Waterfox, thanks to @dowster! Run granted browser set and choose the option to update your browser preference.

Auto refresh for assuming roles that use Credential Process

We've introduced automatic credential refresh when assuming roles that use the credential process. Now by default, we export only the AWS_PROFILE environment variable. If you want to export all variables, you can use the --export-all-env-vars flag when running assume.

What's Changed

• Add codepipeline and codedeploy services by @Jeff-SearchPilot in https://github.com/common-fate/granted/pull/510
• Bump golang.org/x/net from 0.7.0 to 0.17.0 by @dependabot in https://github.com/common-fate/granted/pull/511
• Update aws_sso_assumer by @Eddie023 in https://github.com/common-fate/granted/pull/495
• Do not export aws credentials with credential_process_assumer by @Eddie023 in https://github.com/common-fate/granted/pull/467
• Add Waterfox as a browser option by @dowster in https://github.com/common-fate/granted/pull/512
• FIX: add fallback to provided profile name if getLocalStatePath method fails by @Eddie023 in https://github.com/common-fate/granted/pull/515

New Contributors

• @Jeff-SearchPilot made their first contribution in https://github.com/common-fate/granted/pull/510
• @dowster made their first contribution in https://github.com/common-fate/granted/pull/512

Full Changelog: https://github.com/common-fate/granted/compare/v0.18.0...v0.19.0

Preserves Formatting in .aws/config

Now, the formatting in .aws/config is preserved for commands such as:

s3 = 
    max_concurrent_requests = 100
    max_queue_size = 10000 

Readded the no-credential-process Flag

The no-credential-process flag has been reinstated in the granted sso populate command. We apologize for its accidental removal.

What's Changed

• Add kms to ServiceMap by @polleydium in https://github.com/common-fate/granted/pull/494
• Add acm as a valid service by @wayne-folkes in https://github.com/common-fate/granted/pull/507
• Retains-indentation-in-.aws/config by @shwethaumashanker in https://github.com/common-fate/granted/pull/503
• add no-credential-process flag back into command by @JoshuaWilkes in https://github.com/common-fate/granted/pull/509

New Contributors

• @polleydium made their first contribution in https://github.com/common-fate/granted/pull/494

Full Changelog: https://github.com/common-fate/granted/compare/v0.17.1...v0.18.0

What's Changed

• updated common-fate/cli to improve logging by @shwethaumashanker in https://github.com/common-fate/granted/pull/492

Full Changelog: https://github.com/common-fate/granted/compare/v0.17.0...v0.17.1