Skip to content

Support other CLIs using credential injection #110

Open
@infamousjoeg

Description

@infamousjoeg

Is your feature request related to a problem? Please describe.
The problem with other CLIs is that they write secrets to the local filesystem in plain-text. Alternatively, the end-user has to manually manage the environment variables on the host to include the plain-text secrets.

Describe the solution you'd like
cybr aws <command>
cybr gcloud <command>
etc...

The cybr-cli would execute the other CLI process (https://gobyexample.com/execing-processes) and inject environment variables of a credential set by the end-user. The end-user would provide an Account ID to set for the specific CLI. The Account ID would be written to ~/.cybr/authn and only contain the Account ID. The Account ID could then be used for every cybr aws <command> to retrieve the credentials via API and inject as environment variables. This will prevent the AWS CLI or other CLIs from writing the credentials in plain-text to the file system and gives cybr-cli control over how long the credentials persist as an environment variable.

Describe alternatives you've considered
Summon was considered but requires too many dependencies. Summon + Summon Provider + secrets.yml -OR- cybr cli aws-configure -i AccountID. 🤔

Metadata

Metadata

Assignees

Labels

enhancementNew feature or request

Projects

No projects

Milestone

No milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions