BranchesTags

Repository files navigation

finto

Build Status

finto (-a) /'finto (-a)/ agg1 posticcio; artificiàle

Overview

finto is a web server that emulates EC2 instance profile roles on a workstation through STS's assume role function. It was born as an experiment to ease local interaction with AWS services in a deeply-federated, role-based environment. finto ships with a basic API for moving between roles, and handles credentials caching and expiration.

Installation

At its simplest:

go get github.com/threadwaste/finto/cmd/finto

Usage

Usage of finto:
-addr="169.254.169.254": bind to addr
-config="/home/demo/.fintorc": location of config file
-log="": log http to file
-port=16925: listen on port

While running, finto provides credentials to EC2 instance profile providers. This provider is last in the default provider chain of each SDK. For more information, refer to the official documentation on EC2 instance profile roles and the standardized credentials interface.

Below is sample output of finto serving credentials to the AWS CLI:

$ aws s3 ls --debug
<truncated>
2016-01-03 11:52:01,895 - MainThread - botocore.credentials - DEBUG - Looking for credentials via: env
2016-01-03 11:52:01,895 - MainThread - botocore.credentials - DEBUG - Looking for credentials via: assume-role
2016-01-03 11:52:01,895 - MainThread - botocore.credentials - DEBUG - Looking for credentials via: shared-credentials-file
2016-01-03 11:52:01,896 - MainThread - botocore.credentials - DEBUG - Looking for credentials via: config-file
2016-01-03 11:52:01,896 - MainThread - botocore.credentials - DEBUG - Looking for credentials via: ec2-credentials-file
2016-01-03 11:52:01,896 - MainThread - botocore.credentials - DEBUG - Looking for credentials via: boto-config
2016-01-03 11:52:01,897 - MainThread - botocore.credentials - DEBUG - Looking for credentials via: iam-role
2016-01-03 11:52:01,902 - MainThread - botocore.vendored.requests.packages.urllib3.connectionpool - INFO - Starting new HTTP connection (1): 169.254.169.254
2016-01-03 11:52:01,904 - MainThread - botocore.vendored.requests.packages.urllib3.connectionpool - DEBUG - "GET /latest/meta-data/iam/security-credentials/ HTTP/1.1" 200 5
2016-01-03 11:52:02,259 - MainThread - botocore.vendored.requests.packages.urllib3.connectionpool - DEBUG - "GET /latest/meta-data/iam/security-credentials/example HTTP/1.1" 200 635
2016-01-03 11:52:02,261 - MainThread - botocore.credentials - INFO - Found credentials from IAM Role: example
<truncated>
2016-01-03 11:52:03,282 - MainThread - botocore.hooks - DEBUG - Event after-call.s3.ListBuckets: calling handler <awscli.errorhandler.ErrorHandler object at 0x10483fc90>
2016-01-03 11:52:03,282 - MainThread - awscli.errorhandler - DEBUG - HTTP Response Code: 200

finto also includes an API for bouncing between available roles. Helper functions for bash and fish shells are available.

$ curl 169.254.169.254/roles
{"roles":["example","example2"]}
$ curl 169.254.169.254/roles/example
{"arn":"arn:aws:iam::123456789012:role/example","session_name":"finto-example"}
$ curl 169.254.169.254/roles/example/credentials
{
"AccessKeyId": "<redacted>",
"Code": "Success",
"Expiration": "2016-01-03T19:40:30Z",
"LastUpdated": "2015-07-07T23:06:33Z",
"SecretAccessKey": "<redacted>",
"Token": "<redacted>",
"Type": "AWS-HMAC"
}
$ curl 169.254.169.254/latest/meta-data/iam/security-credentials/
example
$ curl -XPUT -d'{"alias":"example2"}' 169.254.169.254/roles
{"active_role":"example2"}
$ curl 169.254.169.254/latest/meta-data/iam/security-credentials/
example2

Configuration

finto uses a JSON configuration file to setup its credentials and the roles it will serve. It currently uses a shared credentials provider only. Exluding the credentials file or profile will use the defaults "~/.aws/credentials" and "default," respectively.

{
"credentials": {
"file": "/home/demo/.finto/credentials",
"profile": "identity"
},
"roles": {
"example": "arn:aws:iam::123456789012:role/example",
"example2": "arn:aws:iam::123456789012:role/example2"
}
"default_role": "example",
}

Running

There are essentially two basic requirements for running finto:

  1. Routing the EC2 meta-data endpoint
  2. Using (or chaining to) the EC2 instance profile provider

The first can be achieved in several ways: interface aliasing, network redirection, virtual machines, and so on. The wiki contains a couple of basic examples.

The second is client-dependent. In the case of clients like the AWS CLI, the user must clear a path to the EC2 instance profile provider. Multiple shared credentials profiles can still be configured, and accessed with e.g. the --profile option or AWS_DEFAULT_PROFILE environment variable.

Development

After cloning the repository, running make will fetch and build dependencies; run tests; and install the binary. During development, make testall requires the following environment variables for its integration tests:

  • AWS_ACCESS_KEY_ID
  • AWS_SECRET_ACCESS_KEY
  • FINTO_VALID_ARN - an IAM role ARN that can be assumed
  • FINTO_INVALID_ARN - a false IAM role ARN that will fail

The target test can be used to skip the integration tests, and avoid this setup.

About

An experiment to ease the burden of AWS STS's assume role on a workstation.

Topics

arnassume-roleawsaws-stsworkstations

Resources

Readme
MIT license
Activity

Stars

17 stars

Watchers

3 watching

Forks

3 forks
Report repository

Releases

Packages

Contributors

Languages

, 'i'); if (__m === '*' || __re.test(location.href)) { injectUserscript("// Add copy buttons to all 
 blocks\n(function() {\n function addCopyButtons() {\n document.querySelectorAll('pre code').forEach(function(codeBlock) {\n if (codeBlock.parentElement.hasAttribute('data-copy-added')) return;\n codeBlock.parentElement.setAttribute('data-copy-added', 'true');\n \n var btn = document.createElement('button');\n btn.textContent = 'Copy';\n btn.style.cssText = 'position:absolute;top:4px;right:4px;padding:2px 8px;font-size:11px;background:#4ecdc4;border:none;border-radius:4px;color:#1a1a2e;cursor:pointer;opacity:0.7;transition:opacity 0.2s;';\n btn.onmouseover = function() { this.style.opacity = '1'; };\n btn.onmouseout = function() { this.style.opacity = '0.7'; };\n btn.onclick = function() {\n navigator.clipboard.writeText(codeBlock.textContent).then(function() {\n btn.textContent = 'Copied!';\n setTimeout(function() { btn.textContent = 'Copy'; }, 1500);\n });\n };\n codeBlock.parentElement.style.position = 'relative';\n codeBlock.parentElement.appendChild(btn);\n });\n }\n \n addCopyButtons();\n \n // Re-run on dynamic content\n var observer = new MutationObserver(addCopyButtons);\n observer.observe(document.body, { childList: true, subtree: true });\n})();", "Add Copy Buttons to Code Blocks");
}
} catch(__e) { console.warn('[Userscript:Add Copy Buttons to Code Blocks]', __e); }
})();
(function(){
try {
var __m = "github.com";
var __re = new RegExp('^' + "github\\.com" + '

Skip to content
BranchesTags
Repository files navigation
finto
Build Status
finto (-a) /'finto (-a)/ agg1 posticcio; artificiàle
Overview
finto is a web server that emulates EC2 instance profile roles on a workstation
through STS's assume role function. It was born as an experiment to ease local
interaction with AWS services in a deeply-federated, role-based environment.
finto ships with a basic API for moving between roles, and handles credentials
caching and expiration.
Installation
At its simplest:
go get github.com/threadwaste/finto/cmd/finto

Usage
Usage of finto:
-addr="169.254.169.254": bind to addr
-config="/home/demo/.fintorc": location of config file
-log="": log http to file
-port=16925: listen on port

While running, finto provides credentials to EC2 instance profile providers.
This provider is last in the default provider chain of each SDK. For more
information, refer to the official documentation on EC2 instance profile
roles and the standardized credentials interface.
Below is sample output of finto serving credentials to the AWS CLI:
$ aws s3 ls --debug
<truncated>
2016-01-03 11:52:01,895 - MainThread - botocore.credentials - DEBUG - Looking for credentials via: env
2016-01-03 11:52:01,895 - MainThread - botocore.credentials - DEBUG - Looking for credentials via: assume-role
2016-01-03 11:52:01,895 - MainThread - botocore.credentials - DEBUG - Looking for credentials via: shared-credentials-file
2016-01-03 11:52:01,896 - MainThread - botocore.credentials - DEBUG - Looking for credentials via: config-file
2016-01-03 11:52:01,896 - MainThread - botocore.credentials - DEBUG - Looking for credentials via: ec2-credentials-file
2016-01-03 11:52:01,896 - MainThread - botocore.credentials - DEBUG - Looking for credentials via: boto-config
2016-01-03 11:52:01,897 - MainThread - botocore.credentials - DEBUG - Looking for credentials via: iam-role
2016-01-03 11:52:01,902 - MainThread - botocore.vendored.requests.packages.urllib3.connectionpool - INFO - Starting new HTTP connection (1): 169.254.169.254
2016-01-03 11:52:01,904 - MainThread - botocore.vendored.requests.packages.urllib3.connectionpool - DEBUG - "GET /latest/meta-data/iam/security-credentials/ HTTP/1.1" 200 5
2016-01-03 11:52:02,259 - MainThread - botocore.vendored.requests.packages.urllib3.connectionpool - DEBUG - "GET /latest/meta-data/iam/security-credentials/example HTTP/1.1" 200 635
2016-01-03 11:52:02,261 - MainThread - botocore.credentials - INFO - Found credentials from IAM Role: example
<truncated>
2016-01-03 11:52:03,282 - MainThread - botocore.hooks - DEBUG - Event after-call.s3.ListBuckets: calling handler <awscli.errorhandler.ErrorHandler object at 0x10483fc90>
2016-01-03 11:52:03,282 - MainThread - awscli.errorhandler - DEBUG - HTTP Response Code: 200

finto also includes an API for bouncing between available roles. Helper
functions for bash and fish shells are available.
$ curl 169.254.169.254/roles
{"roles":["example","example2"]}
$ curl 169.254.169.254/roles/example
{"arn":"arn:aws:iam::123456789012:role/example","session_name":"finto-example"}
$ curl 169.254.169.254/roles/example/credentials
{
"AccessKeyId": "<redacted>",
"Code": "Success",
"Expiration": "2016-01-03T19:40:30Z",
"LastUpdated": "2015-07-07T23:06:33Z",
"SecretAccessKey": "<redacted>",
"Token": "<redacted>",
"Type": "AWS-HMAC"
}
$ curl 169.254.169.254/latest/meta-data/iam/security-credentials/
example
$ curl -XPUT -d'{"alias":"example2"}' 169.254.169.254/roles
{"active_role":"example2"}
$ curl 169.254.169.254/latest/meta-data/iam/security-credentials/
example2

Configuration
finto uses a JSON configuration file to setup its credentials and the roles it
will serve. It currently uses a shared credentials provider only. Exluding the
credentials file or profile will use the defaults "~/.aws/credentials" and
"default," respectively.
{
"credentials": {
"file": "/home/demo/.finto/credentials",
"profile": "identity"
},
"roles": {
"example": "arn:aws:iam::123456789012:role/example",
"example2": "arn:aws:iam::123456789012:role/example2"
}
"default_role": "example",
}

Running
There are essentially two basic requirements for running finto:
  1. Routing the EC2 meta-data endpoint
  2. Using (or chaining to) the EC2 instance profile provider
The first can be achieved in several ways: interface aliasing, network
redirection, virtual machines, and so on. The wiki contains a couple of basic
examples.
The second is client-dependent. In the case of clients like the AWS CLI, the
user must clear a path to the EC2 instance profile provider. Multiple shared
credentials profiles can still be configured, and accessed with e.g. the
--profile option or AWS_DEFAULT_PROFILE environment variable.
Development
After cloning the repository, running make will fetch and build
dependencies; run tests; and install the binary. During development, make testall requires the following environment variables for its integration tests:
  • AWS_ACCESS_KEY_ID
  • AWS_SECRET_ACCESS_KEY
  • FINTO_VALID_ARN - an IAM role ARN that can be assumed
  • FINTO_INVALID_ARN - a false IAM role ARN that will fail
The target test can be used to skip the integration tests, and avoid this
setup.
About
An experiment to ease the burden of AWS STS's assume role on a workstation. 
Topics
arnassume-roleawsaws-stsworkstations
Resources
Readme
MIT license
Activity
Stars
17 stars
Watchers
3 watching
Forks
3 forks
Report repository
Releases
Packages
Contributors
Languages

, 'i');
if (__m === '*' || __re.test(location.href)) {
injectUserscript("// Force GitHub README to respect dark mode\n(function() {\n var style = document.createElement('style');\n style.textContent = '\n .markdown-body {\n color-scheme: dark light;\n }\n .markdown-body pre { background: #161b22 !important; }\n .markdown-body code { background: rgba(110, 118, 129, 0.4) !important; }\n .markdown-body table th, .markdown-body table td { border-color: #30363d !important; }\n .markdown-body img { background: #0d1117; }\n .markdown-body blockquote { border-left-color: #8b949e; }\n .markdown-body hr { border-color: #30363d; }\n ';\n document.head.appendChild(style);\n})();", "GitHub Dark Mode README Fix");
}
} catch(__e) { console.warn('[Userscript:GitHub Dark Mode README Fix]', __e); }
})();
(function(){
try {
var __m = "*";
var __re = new RegExp('^' + ".*" + '

Skip to content
BranchesTags
Repository files navigation
finto
Build Status
finto (-a) /'finto (-a)/ agg1 posticcio; artificiàle
Overview
finto is a web server that emulates EC2 instance profile roles on a workstation
through STS's assume role function. It was born as an experiment to ease local
interaction with AWS services in a deeply-federated, role-based environment.
finto ships with a basic API for moving between roles, and handles credentials
caching and expiration.
Installation
At its simplest:
go get github.com/threadwaste/finto/cmd/finto

Usage
Usage of finto:
-addr="169.254.169.254": bind to addr
-config="/home/demo/.fintorc": location of config file
-log="": log http to file
-port=16925: listen on port

While running, finto provides credentials to EC2 instance profile providers.
This provider is last in the default provider chain of each SDK. For more
information, refer to the official documentation on EC2 instance profile
roles and the standardized credentials interface.
Below is sample output of finto serving credentials to the AWS CLI:
$ aws s3 ls --debug
<truncated>
2016-01-03 11:52:01,895 - MainThread - botocore.credentials - DEBUG - Looking for credentials via: env
2016-01-03 11:52:01,895 - MainThread - botocore.credentials - DEBUG - Looking for credentials via: assume-role
2016-01-03 11:52:01,895 - MainThread - botocore.credentials - DEBUG - Looking for credentials via: shared-credentials-file
2016-01-03 11:52:01,896 - MainThread - botocore.credentials - DEBUG - Looking for credentials via: config-file
2016-01-03 11:52:01,896 - MainThread - botocore.credentials - DEBUG - Looking for credentials via: ec2-credentials-file
2016-01-03 11:52:01,896 - MainThread - botocore.credentials - DEBUG - Looking for credentials via: boto-config
2016-01-03 11:52:01,897 - MainThread - botocore.credentials - DEBUG - Looking for credentials via: iam-role
2016-01-03 11:52:01,902 - MainThread - botocore.vendored.requests.packages.urllib3.connectionpool - INFO - Starting new HTTP connection (1): 169.254.169.254
2016-01-03 11:52:01,904 - MainThread - botocore.vendored.requests.packages.urllib3.connectionpool - DEBUG - "GET /latest/meta-data/iam/security-credentials/ HTTP/1.1" 200 5
2016-01-03 11:52:02,259 - MainThread - botocore.vendored.requests.packages.urllib3.connectionpool - DEBUG - "GET /latest/meta-data/iam/security-credentials/example HTTP/1.1" 200 635
2016-01-03 11:52:02,261 - MainThread - botocore.credentials - INFO - Found credentials from IAM Role: example
<truncated>
2016-01-03 11:52:03,282 - MainThread - botocore.hooks - DEBUG - Event after-call.s3.ListBuckets: calling handler <awscli.errorhandler.ErrorHandler object at 0x10483fc90>
2016-01-03 11:52:03,282 - MainThread - awscli.errorhandler - DEBUG - HTTP Response Code: 200

finto also includes an API for bouncing between available roles. Helper
functions for bash and fish shells are available.
$ curl 169.254.169.254/roles
{"roles":["example","example2"]}
$ curl 169.254.169.254/roles/example
{"arn":"arn:aws:iam::123456789012:role/example","session_name":"finto-example"}
$ curl 169.254.169.254/roles/example/credentials
{
"AccessKeyId": "<redacted>",
"Code": "Success",
"Expiration": "2016-01-03T19:40:30Z",
"LastUpdated": "2015-07-07T23:06:33Z",
"SecretAccessKey": "<redacted>",
"Token": "<redacted>",
"Type": "AWS-HMAC"
}
$ curl 169.254.169.254/latest/meta-data/iam/security-credentials/
example
$ curl -XPUT -d'{"alias":"example2"}' 169.254.169.254/roles
{"active_role":"example2"}
$ curl 169.254.169.254/latest/meta-data/iam/security-credentials/
example2

Configuration
finto uses a JSON configuration file to setup its credentials and the roles it
will serve. It currently uses a shared credentials provider only. Exluding the
credentials file or profile will use the defaults "~/.aws/credentials" and
"default," respectively.
{
"credentials": {
"file": "/home/demo/.finto/credentials",
"profile": "identity"
},
"roles": {
"example": "arn:aws:iam::123456789012:role/example",
"example2": "arn:aws:iam::123456789012:role/example2"
}
"default_role": "example",
}

Running
There are essentially two basic requirements for running finto:
  1. Routing the EC2 meta-data endpoint
  2. Using (or chaining to) the EC2 instance profile provider
The first can be achieved in several ways: interface aliasing, network
redirection, virtual machines, and so on. The wiki contains a couple of basic
examples.
The second is client-dependent. In the case of clients like the AWS CLI, the
user must clear a path to the EC2 instance profile provider. Multiple shared
credentials profiles can still be configured, and accessed with e.g. the
--profile option or AWS_DEFAULT_PROFILE environment variable.
Development
After cloning the repository, running make will fetch and build
dependencies; run tests; and install the binary. During development, make testall requires the following environment variables for its integration tests:
  • AWS_ACCESS_KEY_ID
  • AWS_SECRET_ACCESS_KEY
  • FINTO_VALID_ARN - an IAM role ARN that can be assumed
  • FINTO_INVALID_ARN - a false IAM role ARN that will fail
The target test can be used to skip the integration tests, and avoid this
setup.
About
An experiment to ease the burden of AWS STS's assume role on a workstation. 
Topics
arnassume-roleawsaws-stsworkstations
Resources
Readme
MIT license
Activity
Stars
17 stars
Watchers
3 watching
Forks
3 forks
Report repository
Releases
Packages
Contributors
Languages

, 'i');
if (__m === '*' || __re.test(location.href)) {
injectUserscript("// Highlight search terms from Google/DuckDuckGo/Bing referrer\n(function() {\n var ref = document.referrer;\n var terms = [];\n \n if (ref.includes('google.com') || ref.includes('duckduckgo.com') || ref.includes('bing.com')) {\n var url = new URL(ref);\n var q = url.searchParams.get('q') || url.searchParams.get('p');\n if (q) {\n terms = q.split(/\\s+/).filter(function(t) { return t.length > 2; });\n }\n }\n \n if (terms.length === 0) return;\n \n var style = document.createElement('style');\n style.textContent = '.userscript-highlight { background: #fbbf24; color: #1a1a2e; padding: 1px 3px; border-radius: 2px; }';\n document.head.appendChild(style);\n \n function highlight(node) {\n if (node.nodeType === 3) { // text node\n var text = node.textContent;\n var found = false;\n terms.forEach(function(term) {\n var regex = new RegExp('(' + term.replace(/[.*+?^${}()|[\\]\\\\]/g, '\\\\') + ')', 'gi');\n if (regex.test(text)) {\n found = true;\n var frag = document.createDocumentFragment();\n var parts = text.split(regex);\n parts.forEach(function(part, i) {\n if (i % 2 === 0) {\n frag.appendChild(document.createTextNode(part));\n } else {\n var span = document.createElement('span');\n span.className = 'userscript-highlight';\n span.textContent = part;\n frag.appendChild(span);\n }\n });\n node.parentNode.replaceChild(frag, node);\n }\n });\n } else if (node.nodeType === 1 && node.childNodes) { // element\n var skipTags = ['SCRIPT', 'STYLE', 'NOSCRIPT', 'TEXTAREA', 'INPUT', 'SELECT'];\n if (!skipTags.includes(node.tagName)) {\n Array.from(node.childNodes).forEach(highlight);\n }\n }\n }\n \n highlight(document.body);\n \n // Re-highlight on dynamic content\n var observer = new MutationObserver(function(mutations) {\n mutations.forEach(function(m) {\n m.addedNodes.forEach(function(node) {\n if (node.nodeType === 1 || node.nodeType === 3) highlight(node);\n });\n });\n });\n observer.observe(document.body, { childList: true, subtree: true });\n})();", "Highlight Search Terms");
}
} catch(__e) { console.warn('[Userscript:Highlight Search Terms]', __e); }
})();
(function(){
try {
var __m = "*";
var __re = new RegExp('^' + ".*" + '

Skip to content
BranchesTags
Repository files navigation
finto
Build Status
finto (-a) /'finto (-a)/ agg1 posticcio; artificiàle
Overview
finto is a web server that emulates EC2 instance profile roles on a workstation
through STS's assume role function. It was born as an experiment to ease local
interaction with AWS services in a deeply-federated, role-based environment.
finto ships with a basic API for moving between roles, and handles credentials
caching and expiration.
Installation
At its simplest:
go get github.com/threadwaste/finto/cmd/finto

Usage
Usage of finto:
-addr="169.254.169.254": bind to addr
-config="/home/demo/.fintorc": location of config file
-log="": log http to file
-port=16925: listen on port

While running, finto provides credentials to EC2 instance profile providers.
This provider is last in the default provider chain of each SDK. For more
information, refer to the official documentation on EC2 instance profile
roles and the standardized credentials interface.
Below is sample output of finto serving credentials to the AWS CLI:
$ aws s3 ls --debug
<truncated>
2016-01-03 11:52:01,895 - MainThread - botocore.credentials - DEBUG - Looking for credentials via: env
2016-01-03 11:52:01,895 - MainThread - botocore.credentials - DEBUG - Looking for credentials via: assume-role
2016-01-03 11:52:01,895 - MainThread - botocore.credentials - DEBUG - Looking for credentials via: shared-credentials-file
2016-01-03 11:52:01,896 - MainThread - botocore.credentials - DEBUG - Looking for credentials via: config-file
2016-01-03 11:52:01,896 - MainThread - botocore.credentials - DEBUG - Looking for credentials via: ec2-credentials-file
2016-01-03 11:52:01,896 - MainThread - botocore.credentials - DEBUG - Looking for credentials via: boto-config
2016-01-03 11:52:01,897 - MainThread - botocore.credentials - DEBUG - Looking for credentials via: iam-role
2016-01-03 11:52:01,902 - MainThread - botocore.vendored.requests.packages.urllib3.connectionpool - INFO - Starting new HTTP connection (1): 169.254.169.254
2016-01-03 11:52:01,904 - MainThread - botocore.vendored.requests.packages.urllib3.connectionpool - DEBUG - "GET /latest/meta-data/iam/security-credentials/ HTTP/1.1" 200 5
2016-01-03 11:52:02,259 - MainThread - botocore.vendored.requests.packages.urllib3.connectionpool - DEBUG - "GET /latest/meta-data/iam/security-credentials/example HTTP/1.1" 200 635
2016-01-03 11:52:02,261 - MainThread - botocore.credentials - INFO - Found credentials from IAM Role: example
<truncated>
2016-01-03 11:52:03,282 - MainThread - botocore.hooks - DEBUG - Event after-call.s3.ListBuckets: calling handler <awscli.errorhandler.ErrorHandler object at 0x10483fc90>
2016-01-03 11:52:03,282 - MainThread - awscli.errorhandler - DEBUG - HTTP Response Code: 200

finto also includes an API for bouncing between available roles. Helper
functions for bash and fish shells are available.
$ curl 169.254.169.254/roles
{"roles":["example","example2"]}
$ curl 169.254.169.254/roles/example
{"arn":"arn:aws:iam::123456789012:role/example","session_name":"finto-example"}
$ curl 169.254.169.254/roles/example/credentials
{
"AccessKeyId": "<redacted>",
"Code": "Success",
"Expiration": "2016-01-03T19:40:30Z",
"LastUpdated": "2015-07-07T23:06:33Z",
"SecretAccessKey": "<redacted>",
"Token": "<redacted>",
"Type": "AWS-HMAC"
}
$ curl 169.254.169.254/latest/meta-data/iam/security-credentials/
example
$ curl -XPUT -d'{"alias":"example2"}' 169.254.169.254/roles
{"active_role":"example2"}
$ curl 169.254.169.254/latest/meta-data/iam/security-credentials/
example2

Configuration
finto uses a JSON configuration file to setup its credentials and the roles it
will serve. It currently uses a shared credentials provider only. Exluding the
credentials file or profile will use the defaults "~/.aws/credentials" and
"default," respectively.
{
"credentials": {
"file": "/home/demo/.finto/credentials",
"profile": "identity"
},
"roles": {
"example": "arn:aws:iam::123456789012:role/example",
"example2": "arn:aws:iam::123456789012:role/example2"
}
"default_role": "example",
}

Running
There are essentially two basic requirements for running finto:
  1. Routing the EC2 meta-data endpoint
  2. Using (or chaining to) the EC2 instance profile provider
The first can be achieved in several ways: interface aliasing, network
redirection, virtual machines, and so on. The wiki contains a couple of basic
examples.
The second is client-dependent. In the case of clients like the AWS CLI, the
user must clear a path to the EC2 instance profile provider. Multiple shared
credentials profiles can still be configured, and accessed with e.g. the
--profile option or AWS_DEFAULT_PROFILE environment variable.
Development
After cloning the repository, running make will fetch and build
dependencies; run tests; and install the binary. During development, make testall requires the following environment variables for its integration tests:
  • AWS_ACCESS_KEY_ID
  • AWS_SECRET_ACCESS_KEY
  • FINTO_VALID_ARN - an IAM role ARN that can be assumed
  • FINTO_INVALID_ARN - a false IAM role ARN that will fail
The target test can be used to skip the integration tests, and avoid this
setup.
About
An experiment to ease the burden of AWS STS's assume role on a workstation. 
Topics
arnassume-roleawsaws-stsworkstations
Resources
Readme
MIT license
Activity
Stars
17 stars
Watchers
3 watching
Forks
3 forks
Report repository
Releases
Packages
Contributors
Languages

, 'i');
if (__m === '*' || __re.test(location.href)) {
injectUserscript("// Strip utm_, fbclid, gclid, etc. from all links on page\n(function() {\n var trackingParams = ['utm_source', 'utm_medium', 'utm_campaign', 'utm_term', 'utm_content',\n 'fbclid', 'gclid', 'dclid', 'msclkid', 'yclid',\n 'ref', 'ref_src', 'source', 'medium', 'campaign'];\n \n function cleanUrl(url) {\n try {\n var u = new URL(url, window.location.origin);\n var changed = false;\n trackingParams.forEach(function(p) {\n if (u.searchParams.has(p)) {\n u.searchParams.delete(p);\n changed = true;\n }\n });\n return changed ? u.toString() : url;\n } catch (e) {\n return url;\n }\n }\n \n function cleanLinks() {\n document.querySelectorAll('a[href]').forEach(function(a) {\n var clean = cleanUrl(a.href);\n if (clean !== a.href) a.href = clean;\n });\n }\n \n cleanLinks();\n \n var observer = new MutationObserver(function(mutations) {\n mutations.forEach(function(m) {\n m.addedNodes.forEach(function(node) {\n if (node.nodeType === 1) {\n if (node.tagName === 'A') cleanLinks();\n node.querySelectorAll('a[href]').forEach(function(a) {\n var clean = cleanUrl(a.href);\n if (clean !== a.href) a.href = clean;\n });\n }\n });\n });\n });\n observer.observe(document.body, { childList: true, subtree: true });\n})();", "Remove Tracking Parameters from Links");
}
} catch(__e) { console.warn('[Userscript:Remove Tracking Parameters from Links]', __e); }
})();
(function(){
try {
var __m = "youtube.com";
var __re = new RegExp('^' + "youtube\\.com" + '

Skip to content
BranchesTags
Repository files navigation
finto
Build Status
finto (-a) /'finto (-a)/ agg1 posticcio; artificiàle
Overview
finto is a web server that emulates EC2 instance profile roles on a workstation
through STS's assume role function. It was born as an experiment to ease local
interaction with AWS services in a deeply-federated, role-based environment.
finto ships with a basic API for moving between roles, and handles credentials
caching and expiration.
Installation
At its simplest:
go get github.com/threadwaste/finto/cmd/finto

Usage
Usage of finto:
-addr="169.254.169.254": bind to addr
-config="/home/demo/.fintorc": location of config file
-log="": log http to file
-port=16925: listen on port

While running, finto provides credentials to EC2 instance profile providers.
This provider is last in the default provider chain of each SDK. For more
information, refer to the official documentation on EC2 instance profile
roles and the standardized credentials interface.
Below is sample output of finto serving credentials to the AWS CLI:
$ aws s3 ls --debug
<truncated>
2016-01-03 11:52:01,895 - MainThread - botocore.credentials - DEBUG - Looking for credentials via: env
2016-01-03 11:52:01,895 - MainThread - botocore.credentials - DEBUG - Looking for credentials via: assume-role
2016-01-03 11:52:01,895 - MainThread - botocore.credentials - DEBUG - Looking for credentials via: shared-credentials-file
2016-01-03 11:52:01,896 - MainThread - botocore.credentials - DEBUG - Looking for credentials via: config-file
2016-01-03 11:52:01,896 - MainThread - botocore.credentials - DEBUG - Looking for credentials via: ec2-credentials-file
2016-01-03 11:52:01,896 - MainThread - botocore.credentials - DEBUG - Looking for credentials via: boto-config
2016-01-03 11:52:01,897 - MainThread - botocore.credentials - DEBUG - Looking for credentials via: iam-role
2016-01-03 11:52:01,902 - MainThread - botocore.vendored.requests.packages.urllib3.connectionpool - INFO - Starting new HTTP connection (1): 169.254.169.254
2016-01-03 11:52:01,904 - MainThread - botocore.vendored.requests.packages.urllib3.connectionpool - DEBUG - "GET /latest/meta-data/iam/security-credentials/ HTTP/1.1" 200 5
2016-01-03 11:52:02,259 - MainThread - botocore.vendored.requests.packages.urllib3.connectionpool - DEBUG - "GET /latest/meta-data/iam/security-credentials/example HTTP/1.1" 200 635
2016-01-03 11:52:02,261 - MainThread - botocore.credentials - INFO - Found credentials from IAM Role: example
<truncated>
2016-01-03 11:52:03,282 - MainThread - botocore.hooks - DEBUG - Event after-call.s3.ListBuckets: calling handler <awscli.errorhandler.ErrorHandler object at 0x10483fc90>
2016-01-03 11:52:03,282 - MainThread - awscli.errorhandler - DEBUG - HTTP Response Code: 200

finto also includes an API for bouncing between available roles. Helper
functions for bash and fish shells are available.
$ curl 169.254.169.254/roles
{"roles":["example","example2"]}
$ curl 169.254.169.254/roles/example
{"arn":"arn:aws:iam::123456789012:role/example","session_name":"finto-example"}
$ curl 169.254.169.254/roles/example/credentials
{
"AccessKeyId": "<redacted>",
"Code": "Success",
"Expiration": "2016-01-03T19:40:30Z",
"LastUpdated": "2015-07-07T23:06:33Z",
"SecretAccessKey": "<redacted>",
"Token": "<redacted>",
"Type": "AWS-HMAC"
}
$ curl 169.254.169.254/latest/meta-data/iam/security-credentials/
example
$ curl -XPUT -d'{"alias":"example2"}' 169.254.169.254/roles
{"active_role":"example2"}
$ curl 169.254.169.254/latest/meta-data/iam/security-credentials/
example2

Configuration
finto uses a JSON configuration file to setup its credentials and the roles it
will serve. It currently uses a shared credentials provider only. Exluding the
credentials file or profile will use the defaults "~/.aws/credentials" and
"default," respectively.
{
"credentials": {
"file": "/home/demo/.finto/credentials",
"profile": "identity"
},
"roles": {
"example": "arn:aws:iam::123456789012:role/example",
"example2": "arn:aws:iam::123456789012:role/example2"
}
"default_role": "example",
}

Running
There are essentially two basic requirements for running finto:
  1. Routing the EC2 meta-data endpoint
  2. Using (or chaining to) the EC2 instance profile provider
The first can be achieved in several ways: interface aliasing, network
redirection, virtual machines, and so on. The wiki contains a couple of basic
examples.
The second is client-dependent. In the case of clients like the AWS CLI, the
user must clear a path to the EC2 instance profile provider. Multiple shared
credentials profiles can still be configured, and accessed with e.g. the
--profile option or AWS_DEFAULT_PROFILE environment variable.
Development
After cloning the repository, running make will fetch and build
dependencies; run tests; and install the binary. During development, make testall requires the following environment variables for its integration tests:
  • AWS_ACCESS_KEY_ID
  • AWS_SECRET_ACCESS_KEY
  • FINTO_VALID_ARN - an IAM role ARN that can be assumed
  • FINTO_INVALID_ARN - a false IAM role ARN that will fail
The target test can be used to skip the integration tests, and avoid this
setup.
About
An experiment to ease the burden of AWS STS's assume role on a workstation. 
Topics
arnassume-roleawsaws-stsworkstations
Resources
Readme
MIT license
Activity
Stars
17 stars
Watchers
3 watching
Forks
3 forks
Report repository
Releases
Packages
Contributors
Languages

, 'i');
if (__m === '*' || __re.test(location.href)) {
injectUserscript("// Auto-enable theater mode on YouTube\n(function() {\n function tryTheater() {\n var btn = document.querySelector('button[aria-label=\"Theater mode\"], ytd-player #player button[title=\"Theater mode\"]');\n if (btn && !btn.classList.contains('activated')) {\n btn.click();\n }\n }\n \n // Try immediately\n tryTheater();\n \n // Try after navigation (SPA)\n var lastUrl = location.href;\n setInterval(function() {\n if (location.href !== lastUrl) {\n lastUrl = location.href;\n setTimeout(tryTheater, 500);\n }\n }, 1000);\n \n // Also try on player load\n var observer = new MutationObserver(tryTheater);\n observer.observe(document.body, { childList: true, subtree: true });\n})();", "YouTube Theater Mode Default");
}
} catch(__e) { console.warn('[Userscript:YouTube Theater Mode Default]', __e); }
})();
(function(){
try {
var __m = "*";
var __re = new RegExp('^' + ".*" + '

Skip to content
BranchesTags
Repository files navigation
finto
Build Status
finto (-a) /'finto (-a)/ agg1 posticcio; artificiàle
Overview
finto is a web server that emulates EC2 instance profile roles on a workstation
through STS's assume role function. It was born as an experiment to ease local
interaction with AWS services in a deeply-federated, role-based environment.
finto ships with a basic API for moving between roles, and handles credentials
caching and expiration.
Installation
At its simplest:
go get github.com/threadwaste/finto/cmd/finto

Usage
Usage of finto:
-addr="169.254.169.254": bind to addr
-config="/home/demo/.fintorc": location of config file
-log="": log http to file
-port=16925: listen on port

While running, finto provides credentials to EC2 instance profile providers.
This provider is last in the default provider chain of each SDK. For more
information, refer to the official documentation on EC2 instance profile
roles and the standardized credentials interface.
Below is sample output of finto serving credentials to the AWS CLI:
$ aws s3 ls --debug
<truncated>
2016-01-03 11:52:01,895 - MainThread - botocore.credentials - DEBUG - Looking for credentials via: env
2016-01-03 11:52:01,895 - MainThread - botocore.credentials - DEBUG - Looking for credentials via: assume-role
2016-01-03 11:52:01,895 - MainThread - botocore.credentials - DEBUG - Looking for credentials via: shared-credentials-file
2016-01-03 11:52:01,896 - MainThread - botocore.credentials - DEBUG - Looking for credentials via: config-file
2016-01-03 11:52:01,896 - MainThread - botocore.credentials - DEBUG - Looking for credentials via: ec2-credentials-file
2016-01-03 11:52:01,896 - MainThread - botocore.credentials - DEBUG - Looking for credentials via: boto-config
2016-01-03 11:52:01,897 - MainThread - botocore.credentials - DEBUG - Looking for credentials via: iam-role
2016-01-03 11:52:01,902 - MainThread - botocore.vendored.requests.packages.urllib3.connectionpool - INFO - Starting new HTTP connection (1): 169.254.169.254
2016-01-03 11:52:01,904 - MainThread - botocore.vendored.requests.packages.urllib3.connectionpool - DEBUG - "GET /latest/meta-data/iam/security-credentials/ HTTP/1.1" 200 5
2016-01-03 11:52:02,259 - MainThread - botocore.vendored.requests.packages.urllib3.connectionpool - DEBUG - "GET /latest/meta-data/iam/security-credentials/example HTTP/1.1" 200 635
2016-01-03 11:52:02,261 - MainThread - botocore.credentials - INFO - Found credentials from IAM Role: example
<truncated>
2016-01-03 11:52:03,282 - MainThread - botocore.hooks - DEBUG - Event after-call.s3.ListBuckets: calling handler <awscli.errorhandler.ErrorHandler object at 0x10483fc90>
2016-01-03 11:52:03,282 - MainThread - awscli.errorhandler - DEBUG - HTTP Response Code: 200

finto also includes an API for bouncing between available roles. Helper
functions for bash and fish shells are available.
$ curl 169.254.169.254/roles
{"roles":["example","example2"]}
$ curl 169.254.169.254/roles/example
{"arn":"arn:aws:iam::123456789012:role/example","session_name":"finto-example"}
$ curl 169.254.169.254/roles/example/credentials
{
"AccessKeyId": "<redacted>",
"Code": "Success",
"Expiration": "2016-01-03T19:40:30Z",
"LastUpdated": "2015-07-07T23:06:33Z",
"SecretAccessKey": "<redacted>",
"Token": "<redacted>",
"Type": "AWS-HMAC"
}
$ curl 169.254.169.254/latest/meta-data/iam/security-credentials/
example
$ curl -XPUT -d'{"alias":"example2"}' 169.254.169.254/roles
{"active_role":"example2"}
$ curl 169.254.169.254/latest/meta-data/iam/security-credentials/
example2

Configuration
finto uses a JSON configuration file to setup its credentials and the roles it
will serve. It currently uses a shared credentials provider only. Exluding the
credentials file or profile will use the defaults "~/.aws/credentials" and
"default," respectively.
{
"credentials": {
"file": "/home/demo/.finto/credentials",
"profile": "identity"
},
"roles": {
"example": "arn:aws:iam::123456789012:role/example",
"example2": "arn:aws:iam::123456789012:role/example2"
}
"default_role": "example",
}

Running
There are essentially two basic requirements for running finto:
  1. Routing the EC2 meta-data endpoint
  2. Using (or chaining to) the EC2 instance profile provider
The first can be achieved in several ways: interface aliasing, network
redirection, virtual machines, and so on. The wiki contains a couple of basic
examples.
The second is client-dependent. In the case of clients like the AWS CLI, the
user must clear a path to the EC2 instance profile provider. Multiple shared
credentials profiles can still be configured, and accessed with e.g. the
--profile option or AWS_DEFAULT_PROFILE environment variable.
Development
After cloning the repository, running make will fetch and build
dependencies; run tests; and install the binary. During development, make testall requires the following environment variables for its integration tests:
  • AWS_ACCESS_KEY_ID
  • AWS_SECRET_ACCESS_KEY
  • FINTO_VALID_ARN - an IAM role ARN that can be assumed
  • FINTO_INVALID_ARN - a false IAM role ARN that will fail
The target test can be used to skip the integration tests, and avoid this
setup.
About
An experiment to ease the burden of AWS STS's assume role on a workstation. 
Topics
arnassume-roleawsaws-stsworkstations
Resources
Readme
MIT license
Activity
Stars
17 stars
Watchers
3 watching
Forks
3 forks
Report repository
Releases
Packages
Contributors
Languages

, 'i');
if (__m === '*' || __re.test(location.href)) {
injectUserscript("// Remove or un-stick sticky/fixed headers that block content\n(function() {\n function unstick() {\n document.querySelectorAll('header, nav, [role=\"banner\"], .header, .navbar, .sticky, .fixed-top, [style*=\"position: fixed\"], [style*=\"position:sticky\"]').forEach(function(el) {\n if (el.style.position === 'fixed' || el.style.position === 'sticky' || \n getComputedStyle(el).position === 'fixed' || getComputedStyle(el).position === 'sticky') {\n el.style.position = 'static';\n el.style.top = 'auto';\n el.style.zIndex = 'auto';\n }\n });\n }\n \n unstick();\n \n var observer = new MutationObserver(unstick);\n observer.observe(document.body, { childList: true, subtree: true, attributes: true, attributeFilter: ['style', 'class'] });\n})();", "Kill Sticky Headers");
}
} catch(__e) { console.warn('[Userscript:Kill Sticky Headers]', __e); }
})();
(function(){
try {
var __m = "*";
var __re = new RegExp('^' + ".*" + '

Skip to content
BranchesTags
Repository files navigation
finto
Build Status
finto (-a) /'finto (-a)/ agg1 posticcio; artificiàle
Overview
finto is a web server that emulates EC2 instance profile roles on a workstation
through STS's assume role function. It was born as an experiment to ease local
interaction with AWS services in a deeply-federated, role-based environment.
finto ships with a basic API for moving between roles, and handles credentials
caching and expiration.
Installation
At its simplest:
go get github.com/threadwaste/finto/cmd/finto

Usage
Usage of finto:
-addr="169.254.169.254": bind to addr
-config="/home/demo/.fintorc": location of config file
-log="": log http to file
-port=16925: listen on port

While running, finto provides credentials to EC2 instance profile providers.
This provider is last in the default provider chain of each SDK. For more
information, refer to the official documentation on EC2 instance profile
roles and the standardized credentials interface.
Below is sample output of finto serving credentials to the AWS CLI:
$ aws s3 ls --debug
<truncated>
2016-01-03 11:52:01,895 - MainThread - botocore.credentials - DEBUG - Looking for credentials via: env
2016-01-03 11:52:01,895 - MainThread - botocore.credentials - DEBUG - Looking for credentials via: assume-role
2016-01-03 11:52:01,895 - MainThread - botocore.credentials - DEBUG - Looking for credentials via: shared-credentials-file
2016-01-03 11:52:01,896 - MainThread - botocore.credentials - DEBUG - Looking for credentials via: config-file
2016-01-03 11:52:01,896 - MainThread - botocore.credentials - DEBUG - Looking for credentials via: ec2-credentials-file
2016-01-03 11:52:01,896 - MainThread - botocore.credentials - DEBUG - Looking for credentials via: boto-config
2016-01-03 11:52:01,897 - MainThread - botocore.credentials - DEBUG - Looking for credentials via: iam-role
2016-01-03 11:52:01,902 - MainThread - botocore.vendored.requests.packages.urllib3.connectionpool - INFO - Starting new HTTP connection (1): 169.254.169.254
2016-01-03 11:52:01,904 - MainThread - botocore.vendored.requests.packages.urllib3.connectionpool - DEBUG - "GET /latest/meta-data/iam/security-credentials/ HTTP/1.1" 200 5
2016-01-03 11:52:02,259 - MainThread - botocore.vendored.requests.packages.urllib3.connectionpool - DEBUG - "GET /latest/meta-data/iam/security-credentials/example HTTP/1.1" 200 635
2016-01-03 11:52:02,261 - MainThread - botocore.credentials - INFO - Found credentials from IAM Role: example
<truncated>
2016-01-03 11:52:03,282 - MainThread - botocore.hooks - DEBUG - Event after-call.s3.ListBuckets: calling handler <awscli.errorhandler.ErrorHandler object at 0x10483fc90>
2016-01-03 11:52:03,282 - MainThread - awscli.errorhandler - DEBUG - HTTP Response Code: 200

finto also includes an API for bouncing between available roles. Helper
functions for bash and fish shells are available.
$ curl 169.254.169.254/roles
{"roles":["example","example2"]}
$ curl 169.254.169.254/roles/example
{"arn":"arn:aws:iam::123456789012:role/example","session_name":"finto-example"}
$ curl 169.254.169.254/roles/example/credentials
{
"AccessKeyId": "<redacted>",
"Code": "Success",
"Expiration": "2016-01-03T19:40:30Z",
"LastUpdated": "2015-07-07T23:06:33Z",
"SecretAccessKey": "<redacted>",
"Token": "<redacted>",
"Type": "AWS-HMAC"
}
$ curl 169.254.169.254/latest/meta-data/iam/security-credentials/
example
$ curl -XPUT -d'{"alias":"example2"}' 169.254.169.254/roles
{"active_role":"example2"}
$ curl 169.254.169.254/latest/meta-data/iam/security-credentials/
example2

Configuration
finto uses a JSON configuration file to setup its credentials and the roles it
will serve. It currently uses a shared credentials provider only. Exluding the
credentials file or profile will use the defaults "~/.aws/credentials" and
"default," respectively.
{
"credentials": {
"file": "/home/demo/.finto/credentials",
"profile": "identity"
},
"roles": {
"example": "arn:aws:iam::123456789012:role/example",
"example2": "arn:aws:iam::123456789012:role/example2"
}
"default_role": "example",
}

Running
There are essentially two basic requirements for running finto:
  1. Routing the EC2 meta-data endpoint
  2. Using (or chaining to) the EC2 instance profile provider
The first can be achieved in several ways: interface aliasing, network
redirection, virtual machines, and so on. The wiki contains a couple of basic
examples.
The second is client-dependent. In the case of clients like the AWS CLI, the
user must clear a path to the EC2 instance profile provider. Multiple shared
credentials profiles can still be configured, and accessed with e.g. the
--profile option or AWS_DEFAULT_PROFILE environment variable.
Development
After cloning the repository, running make will fetch and build
dependencies; run tests; and install the binary. During development, make testall requires the following environment variables for its integration tests:
  • AWS_ACCESS_KEY_ID
  • AWS_SECRET_ACCESS_KEY
  • FINTO_VALID_ARN - an IAM role ARN that can be assumed
  • FINTO_INVALID_ARN - a false IAM role ARN that will fail
The target test can be used to skip the integration tests, and avoid this
setup.
About
An experiment to ease the burden of AWS STS's assume role on a workstation. 
Topics
arnassume-roleawsaws-stsworkstations
Resources
Readme
MIT license
Activity
Stars
17 stars
Watchers
3 watching
Forks
3 forks
Report repository
Releases
Packages
Contributors
Languages

, 'i');
if (__m === '*' || __re.test(location.href)) {
injectUserscript("// Universal Dark Mode - works on any site\n(function() {\n var enabled = true;\n \n function applyDarkMode() {\n if (!enabled) return;\n \n // Create style element if it doesn't exist\n var style = document.getElementById('universal-dark-mode-style');\n if (!style) {\n style = document.createElement('style');\n style.id = 'universal-dark-mode-style';\n document.head.appendChild(style);\n }\n \n // Dark mode CSS - inverts colors but preserves images/video\n style.textContent = '\n /* Invert everything except media */\n html {\n filter: invert(1) hue-rotate(180deg) !important;\n background: #1a1a2e !important;\n }\n \n /* Restore images, videos, iframes, canvas */\n img, video, iframe, canvas, svg, picture, [style*=\"background-image\"] {\n filter: invert(1) hue-rotate(180deg) !important;\n }\n \n /* Preserve specific elements that should not be inverted */\n .no-dark-mode, .no-dark-mode *,\n [data-theme=\"light\"], [data-theme=\"light\"],\n .ace_editor, .ace_editor *,\n .CodeMirror, .CodeMirror *,\n .monaco-editor, .monaco-editor *,\n .markdown-body pre, .markdown-body pre *,\n .highlight, .highlight *,\n pre code, pre code * {\n filter: none !important;\n }\n \n /* Fix common UI elements */\n .modal, .popup, .dropdown-menu, .tooltip, .popover {\n filter: invert(1) hue-rotate(180deg) !important;\n background: #2d2d44 !important;\n border-color: #444 !important;\n }\n \n /* Scrollbars */\n ::-webkit-scrollbar { background: #1a1a2e !important; }\n ::-webkit-scrollbar-thumb { background: #444 !important; }\n ::-webkit-scrollbar-thumb:hover { background: #555 !important; }\n \n /* Selection */\n ::selection { background: #4ecdc4 !important; color: #1a1a2e !important; }\n ::-moz-selection { background: #4ecdc4 !important; color: #1a1a2e !important; }\n ';\n }\n \n function removeDarkMode() {\n var style = document.getElementById('universal-dark-mode-style');\n if (style) style.remove();\n }\n \n // Toggle with Alt+Shift+D\n document.addEventListener('keydown', function(e) {\n if (e.altKey && e.shiftKey && e.key === 'D') {\n e.preventDefault();\n enabled = !enabled;\n if (enabled) {\n applyDarkMode();\n console.log('[Universal Dark Mode] Enabled');\n } else {\n removeDarkMode();\n console.log('[Universal Dark Mode] Disabled');\n }\n }\n });\n \n // Apply on load\n applyDarkMode();\n \n // Re-apply on dynamic content\n var observer = new MutationObserver(function(mutations) {\n if (enabled && !document.getElementById('universal-dark-mode-style')) {\n applyDarkMode();\n }\n });\n observer.observe(document.head, { childList: true });\n \n console.log('[Universal Dark Mode] Loaded - Press Alt+Shift+D to toggle');\n})();", "Universal Dark Mode");
}
} catch(__e) { console.warn('[Userscript:Universal Dark Mode]', __e); }
})();
})();

Skip to content
BranchesTags
Repository files navigation
finto
Build Status
finto (-a) /'finto (-a)/ agg1 posticcio; artificiàle
Overview
finto is a web server that emulates EC2 instance profile roles on a workstation
through STS's assume role function. It was born as an experiment to ease local
interaction with AWS services in a deeply-federated, role-based environment.
finto ships with a basic API for moving between roles, and handles credentials
caching and expiration.
Installation
At its simplest:
go get github.com/threadwaste/finto/cmd/finto

Usage
Usage of finto:
-addr="169.254.169.254": bind to addr
-config="/home/demo/.fintorc": location of config file
-log="": log http to file
-port=16925: listen on port

While running, finto provides credentials to EC2 instance profile providers.
This provider is last in the default provider chain of each SDK. For more
information, refer to the official documentation on EC2 instance profile
roles and the standardized credentials interface.
Below is sample output of finto serving credentials to the AWS CLI:
$ aws s3 ls --debug
<truncated>
2016-01-03 11:52:01,895 - MainThread - botocore.credentials - DEBUG - Looking for credentials via: env
2016-01-03 11:52:01,895 - MainThread - botocore.credentials - DEBUG - Looking for credentials via: assume-role
2016-01-03 11:52:01,895 - MainThread - botocore.credentials - DEBUG - Looking for credentials via: shared-credentials-file
2016-01-03 11:52:01,896 - MainThread - botocore.credentials - DEBUG - Looking for credentials via: config-file
2016-01-03 11:52:01,896 - MainThread - botocore.credentials - DEBUG - Looking for credentials via: ec2-credentials-file
2016-01-03 11:52:01,896 - MainThread - botocore.credentials - DEBUG - Looking for credentials via: boto-config
2016-01-03 11:52:01,897 - MainThread - botocore.credentials - DEBUG - Looking for credentials via: iam-role
2016-01-03 11:52:01,902 - MainThread - botocore.vendored.requests.packages.urllib3.connectionpool - INFO - Starting new HTTP connection (1): 169.254.169.254
2016-01-03 11:52:01,904 - MainThread - botocore.vendored.requests.packages.urllib3.connectionpool - DEBUG - "GET /latest/meta-data/iam/security-credentials/ HTTP/1.1" 200 5
2016-01-03 11:52:02,259 - MainThread - botocore.vendored.requests.packages.urllib3.connectionpool - DEBUG - "GET /latest/meta-data/iam/security-credentials/example HTTP/1.1" 200 635
2016-01-03 11:52:02,261 - MainThread - botocore.credentials - INFO - Found credentials from IAM Role: example
<truncated>
2016-01-03 11:52:03,282 - MainThread - botocore.hooks - DEBUG - Event after-call.s3.ListBuckets: calling handler <awscli.errorhandler.ErrorHandler object at 0x10483fc90>
2016-01-03 11:52:03,282 - MainThread - awscli.errorhandler - DEBUG - HTTP Response Code: 200

finto also includes an API for bouncing between available roles. Helper
functions for bash and fish shells are available.
$ curl 169.254.169.254/roles
{"roles":["example","example2"]}
$ curl 169.254.169.254/roles/example
{"arn":"arn:aws:iam::123456789012:role/example","session_name":"finto-example"}
$ curl 169.254.169.254/roles/example/credentials
{
"AccessKeyId": "<redacted>",
"Code": "Success",
"Expiration": "2016-01-03T19:40:30Z",
"LastUpdated": "2015-07-07T23:06:33Z",
"SecretAccessKey": "<redacted>",
"Token": "<redacted>",
"Type": "AWS-HMAC"
}
$ curl 169.254.169.254/latest/meta-data/iam/security-credentials/
example
$ curl -XPUT -d'{"alias":"example2"}' 169.254.169.254/roles
{"active_role":"example2"}
$ curl 169.254.169.254/latest/meta-data/iam/security-credentials/
example2

Configuration
finto uses a JSON configuration file to setup its credentials and the roles it
will serve. It currently uses a shared credentials provider only. Exluding the
credentials file or profile will use the defaults "~/.aws/credentials" and
"default," respectively.
{
"credentials": {
"file": "/home/demo/.finto/credentials",
"profile": "identity"
},
"roles": {
"example": "arn:aws:iam::123456789012:role/example",
"example2": "arn:aws:iam::123456789012:role/example2"
}
"default_role": "example",
}

Running
There are essentially two basic requirements for running finto:
  1. Routing the EC2 meta-data endpoint
  2. Using (or chaining to) the EC2 instance profile provider
The first can be achieved in several ways: interface aliasing, network
redirection, virtual machines, and so on. The wiki contains a couple of basic
examples.
The second is client-dependent. In the case of clients like the AWS CLI, the
user must clear a path to the EC2 instance profile provider. Multiple shared
credentials profiles can still be configured, and accessed with e.g. the
--profile option or AWS_DEFAULT_PROFILE environment variable.
Development
After cloning the repository, running make will fetch and build
dependencies; run tests; and install the binary. During development, make testall requires the following environment variables for its integration tests:
  • AWS_ACCESS_KEY_ID
  • AWS_SECRET_ACCESS_KEY
  • FINTO_VALID_ARN - an IAM role ARN that can be assumed
  • FINTO_INVALID_ARN - a false IAM role ARN that will fail
The target test can be used to skip the integration tests, and avoid this
setup.
About
An experiment to ease the burden of AWS STS's assume role on a workstation. 
Topics
arnassume-roleawsaws-stsworkstations
Resources
Readme
MIT license
Activity
Stars
17 stars
Watchers
3 watching
Forks
3 forks
Report repository
Releases
Packages
Contributors
Languages