alias

[toplevel]

whoami = sts get-caller-identity

create-assume-role =
  !f() {
    aws iam create-role --role-name "${1}" \
      --assume-role-policy-document \
        "{\"Statement\":[{\
            \"Action\":\"sts:AssumeRole\",\
            \"Effect\":\"Allow\",\
            \"Principal\":{\"Service\":\""${2}".amazonaws.com\"},\
            \"Sid\":\"\"\
          }],\
          \"Version\":\"2012-10-17\"\
        }";
  }; f


running-instances = ec2 describe-instances \
    --filter Name=instance-state-name,Values=running \
    --output table \
    --query 'Reservations[].Instances[].{ID: InstanceId,Hostname: PublicDnsName,Name: Tags[?Key==`Name`].Value | [0],Type: InstanceType, Platform: Platform || `Linux`}'

ebs-volumes= ec2 describe-volumes \
    --query 'Volumes[].{VolumeId: VolumeId,State: State,Size: Size,Name: Tags[0].Value,AZ: AvailabilityZone}' \
    --output table

amazon-linux-amis = ec2 describe-images \
    --filter \
      Name=owner-alias,Values=amazon \
      Name=name,Values="amzn-ami-hvm-*" \
      Name=architecture,Values=x86_64 \
      Name=virtualization-type,Values=hvm \
      Name=root-device-type,Values=ebs \
      Name=block-device-mapping.volume-type,Values=gp2 \
    --query "reverse(sort_by(Images, &CreationDate))[*].[ImageId,Name,Description]" \
    --output text

list-sgs = ec2 describe-security-groups --query "SecurityGroups[].[GroupId, GroupName]" --output text

sg-rules = !f() { aws ec2 describe-security-groups \
    --query "SecurityGroups[].IpPermissions[].[FromPort,ToPort,IpProtocol,join(',',IpRanges[].CidrIp)]" \
    --group-id "$1" --output text; }; f

tostring =
  !f() {
    jp -f "${1}" 'to_string(@)'
  }; f

tostring-with-jq =
  !f() {
    cat "${1}" | jq 'tostring'
  }; f

authorize-my-ip =
  !f() {
    ip=$(aws myip)
    aws ec2 authorize-security-group-ingress --group-id ${1} --cidr $ip/32 --protocol tcp --port 22
  }; f

get-group-id =
  !f() {
    aws ec2 describe-security-groups --filters Name=group-name,Values=${1} --query SecurityGroups[0].GroupId --output text
  }; f

authorize-my-ip-by-name =
  !f() {
    group_id=$(aws get-group-id "${1}")
    aws authorize-my-ip "$group_id"
  }; f

# list all security group port ranges open to 0.0.0.0/0
public-ports = ec2 describe-security-groups \
  --filters Name=ip-permission.cidr,Values=0.0.0.0/0 \
  --query 'SecurityGroups[].{
    GroupName:GroupName,
    GroupId:GroupId,
    PortRanges:
      IpPermissions[?contains(IpRanges[].CidrIp, `0.0.0.0/0`)].[
        join(`:`, [IpProtocol, join(`-`, [to_string(FromPort), to_string(ToPort)])])
      ][]
  }'

# List or set your region
region = !f() { [[ $# -eq 1 ]] && aws configure set region "$1" || aws configure get region; }; f

find-access-key = !f() {
    clear_to_eol=$(tput el)
    for i in $(aws iam list-users --query "Users[].UserName" --output text); do
      printf "\r%sSearching...$i" "${clear_to_eol}"
      result=$(aws iam list-access-keys --output text --user-name "${i}" --query "AccessKeyMetadata[?AccessKeyId=='${1}'].UserName";)
      if [ -n "${result}" ]; then
         printf "\r%s%s is owned by %s.\n" "${clear_to_eol}" "$1" "${result}"
         break
      fi
    done
    if [ -z "${result}" ]; then
      printf "\r%sKey not found." "${clear_to_eol}"
    fi
  }; f

docker-ecr-login =
  !f() {
    region=$(aws configure get region)
    endpoint=$(aws ecr get-authorization-token --region $region --output text --query authorizationData[].proxyEndpoint)
    passwd=$(aws ecr get-authorization-token --region $region --output text --query authorizationData[].authorizationToken | base64 --decode | cut -d: -f2)
    docker login -u AWS -p $passwd $endpoint
  }; f

myip =
  !f() {
    dig +short myip.opendns.com @resolver1.opendns.com
  }; f

allow-my-ip =
  !f() {
    my_ip=$(aws myip)
    aws ec2 authorize-security-group-ingress --group-name ${1} --protocol ${2} --port ${3} --cidr $my_ip/32
  }; f

revoke-my-ip =
  !f() {
    my_ip=$(aws myip)
    aws ec2 revoke-security-group-ingress --group-name ${1} --protocol ${2} --port ${3} --cidr $my_ip/32
  }; f

allow-my-ip-all =
  !f() {
    aws allow-my-ip ${1} all all
  }; f

revoke-my-ip-all =
  !f() {
    aws revoke-my-ip ${1} all all
  }; f

find-users-without-mfa =
  !f() {
    echo "Users withouth MFA enabled:"
    for i in $(aws iam list-users --query "Users[?PasswordLastUsed].UserName" --output text); do
      result=$(aws iam list-virtual-mfa-devices --query "length(VirtualMFADevices[?User.UserName=='${i}'])")
      if [ "${result}" -eq "0" ]; then
        echo "${i}"
      fi
    done
  }; f

generate-sts-token =
  !f() {
    user_arn=$(aws whoami | jq -r .Arn)
    duration=${1:-3600}
    session_data=$(aws sts get-session-token --duration-seconds $duration)
    echo "# temporary credentials on user ${user_arn} for $duration seconds (expires on $(echo $session_data | jq -r .Credentials.Expiration))"
    echo "export AWS_DEFAULT_REGION=$(aws configure get region)"
    echo "export AWS_ACCESS_KEY_ID=$(echo $session_data | jq -r .Credentials.AccessKeyId)"
    echo "export AWS_SECRET_ACCESS_KEY=$(echo $session_data | jq -r .Credentials.SecretAccessKey)"
    echo "export AWS_SESSION_TOKEN=$(echo $session_data | jq -r .Credentials.SessionToken)"
    echo "export AWS_SECURITY_TOKEN=$(echo $session_data | jq -r .Credentials.SessionToken)"
  }; f

describe-stack-params =
  !f() {
    aws cloudformation describe-stacks --stack-name ${1} | jq -r '.Stacks[0].Parameters[] | .ParameterKey + "=" + .ParameterValue' | sort
  }; f

get-cfn-param-keys =
  !f() {
    stack_json=$(aws cloudformation describe-stacks --stack-name ${1})
    echo ${stack_json} | jq -r '.Stacks[0].Parameters[] | .ParameterKey'
  }; f

set-cfn-params =
  !f() {
    stack_name=$1
    shift
    stack_params=$(aws get-cfn-param-keys $stack_name)

    declare -a params

    for i in "$@"
    do
      key=$(echo ${i%%=*} | cksum | cut -d' ' -f1)  # use cksum as sh array supports only integer indices
      value=${i##*=}

      params[$key]=$value
    done

    out_str=""

    for param in $stack_params
    do
      param_index=$(echo ${param} | cksum | cut -d' ' -f1)

      out_str="${out_str}ParameterKey=${param},"
      if [ ${params[$param_index]+_} ]
      then
        out_str="${out_str}ParameterValue=\"${params[$param_index]}\""
      else
        out_str="${out_str}UsePreviousValue=true"
      fi
      out_str="${out_str} "
    done

    echo $out_str

  }; f

get-cfn-params =
  !f() {
    stack_json=$(aws cloudformation describe-stacks --stack-name ${1})
    echo ${stack_json} | jq -r '.Stacks[0].Parameters[] | { (.ParameterKey): .ParameterValue }' | jq -sS add
  }; f

find-instances-in-sg =
  !f() {
    filter=${2:-Name}
    for i in $(aws ec2 describe-instances --filters "Name=network-interface.group-id,Values=['${1}']" --query "Reservations[].Instances[].Tags[?Key == '${filter}'].Value[]" --output text)
    do
      echo ${i}
    done
  }; f

find-ssh-open = ec2 describe-security-groups \
  --filters Name=ip-permission.from-port,Values=22 \
  --query "SecurityGroups[].{
    GroupName: GroupName,
    GroupId: GroupId,
    IPs: IpPermissions[?to_string(FromPort) == '22'][IpRanges[].CidrIp][][]
  }"

delete-old-ecr-images =
  !f() {
    repository_name=${1}
    leave_amount=${2:-10}
    images=$(aws ecr describe-images --repository-name ${repository_name}) || exit $?
    images_amount=$(echo ${images} | jq -r '.imageDetails | length')

    [ "${images_amount}" -le "${leave_amount}" ] && echo "No old images found." && exit 255

    delete_amount=$(expr ${images_amount} - ${leave_amount})

    echo "Deleting ${delete_amount} image(s)"
    image_digests=$(echo ${images} | jq -r '[(.imageDetails | sort_by(.imagePushedAt)[:'"${delete_amount}"'])[].imageDigest]|join(" imageDigest=")')

    aws ecr batch-delete-image --repository-name ${repository_name} --image-ids imageDigest=${image_digests} || exit $?
  }; f

describe-vpc-subnets =
  !f() {
    aws ec2 describe-subnets --filter="Name=vpc-id,Values=${1}" --query "Subnets[].{SubnetId: SubnetId, Name: Tags[?Key=='Name'].Value | [0], CidrBlock: CidrBlock}" | jq -r 'sort_by(.Name)'
  }; f

list-newest-ecr-images =
  !f() {
    repository_name=${1}
    show_amount=${2:-10}
    images=$(aws ecr describe-images --repository-name ${repository_name}) || exit $?
    images_amount=$(echo ${images} | jq -r '.imageDetails | length')

    (>&2 echo "Found ${images_amount} images. Showing newest ${show_amount}.")
    echo ${images} | jq -r '[(.imageDetails | sort_by(-.imagePushedAt)[:'"${show_amount}"'])[] | { imagePushedAt: .imagePushedAt | strftime("%Y-%m-%dT%H:%M:%SZ"), imageTags }]'
  }; f

get-asg-instance-ips =
  !f() {
    asg_name=${1}
    aws ec2 describe-instances --filters "Name=tag:aws:autoscaling:groupName,Values=${asg_name}" | jq -r '.Reservations[].Instances[].PrivateIpAddress'
  }; f

find-host-by-instance-id =
  !f() {
    instance_id=${1}
    aws ec2 describe-instances --filters "Name=instance-id,Values=${instance_id}" | jq -r '.Reservations[].Instances[].PrivateIpAddress' | sed -E 's/\./-/g; s/^/ip-/'
  }; f

find-untagged-stacks =
  !f() {
    # use tag key as a parameter
    aws cloudformation describe-stacks | jq -r '.Stacks[] | del(select(.Tags[].Key == "'$1'")) | select(.StackName != null) | .StackName'
  }; f

find-instance-by-public-ip =
  !f() {
    aws ec2 describe-instances --filters "Name=ip-address,Values=$1" | jq -r '.Reservations[].Instances[].Tags[] | select(.Key == "Name").Value'
  }; f

find-nat-gateway-by-public-ip =
  !f() {
    aws ec2 describe-nat-gateways | jq -r '.NatGateways[] | select(.NatGatewayAddresses[].PublicIp == "'$1'") | .Tags[] | select(.Key == "Name").Value'
  }; f