step-assume-role-arn.yml

# Version 1.2
# Maintainer: Dariusz Dwornikowski
# Parameters:
# version sets the downloaded  version of assume role arn
# role is required; default: uses $(DEPLOYMENT_ROLE) variable
# external_id is optional; default: uses $(DEPLOYMENT_EXTERNAL_ID) variable
# src_aws_access_key_id is required; default: uses $(SRC-AWS-ACCESS-KEY-ID) variable
# src_aws_secret_access_key is required; default: uses $(SRC-AWS-SECRET-ACCESS-KEY) variable
parameters:
  version: 0.3.4
  role: $(DEPLOYMENT_ROLE)
  external_id: $(DEPLOYMENT_EXTERNAL_ID)
  src_aws_access_key_id: $(SRC-AWS-ACCESS-KEY-ID)
  src_aws_secret_access_key: $(SRC-AWS-SECRET-ACCESS-KEY)

steps:
- bash: |
    if [ -z "$ROLE" ]; then
      echo "##vso[task.logissue type=error;]Missing role parameter"
      echo "##vso[task.complete result=Failed;]"
    fi
    if [ -z "$SRC_AWS_ACCESS_KEY_ID" ]; then 
      echo "##vso[task.logissue type=error;]Missing src_aws_access_key_id parameter"
      echo "##vso[task.complete result=Failed;]"
    fi 
    if [ -z "$SRC_AWS_SECRET_ACCESS_KEY" ]; then 
      echo "##vso[task.logissue type=error;]Missing src_aws_secret_access_key parameter"
      echo "##vso[task.complete result=Failed;]"
    fi 
  env:
    ROLE: ${{ parameters.role }}
    SRC_AWS_ACCESS_KEY_ID: ${{ parameters.src_aws_access_key_id }}
    SRC_AWS_SECRET_ACCESS_KEY: ${{ parameters.src_aws_secret_access_key }}
  displayName: Check parameters
- script: |
    wget https://github.com/nordcloud/assume-role-arn/releases/download/v${{ parameters.version }}/assume-role-arn-linux -O ./assume-role-arn
    chmod +x ./assume-role-arn
  displayName: Download assume-role-arn v${{ parameters.version }}
- script: |
    set -e
    if [ -n "$EXTERNAL_ID" ]; then 
      eval $(AWS_ACCESS_KEY_ID=$SRC_AWS_ACCESS_KEY_ID AWS_SECRET_ACCESS_KEY=$SRC_AWS_SECRET_ACCESS_KEY ./assume-role-arn -r ${{ parameters.role }} -e ${{ parameters.external_id }})
    else 
      eval $(AWS_ACCESS_KEY_ID=$SRC_AWS_ACCESS_KEY_ID AWS_SECRET_ACCESS_KEY=$SRC_AWS_SECRET_ACCESS_KEY ./assume-role-arn -r ${{ parameters.role }})
    fi 
    if [ -n "$AWS_ACCESS_KEY_ID" ]; then
      echo "Setting variables"
      echo "##vso[task.setvariable variable=AWS_ACCESS_KEY_ID;issecret=true]$AWS_ACCESS_KEY_ID"
      echo "##vso[task.setvariable variable=AWS_SECRET_ACCESS_KEY;issecret=true]$AWS_SECRET_ACCESS_KEY"
      echo "##vso[task.setvariable variable=AWS_SESSION_TOKEN;issecret=true]$AWS_SESSION_TOKEN"
    else 
      echo "##vso[task.logissue type=error;]AWS_ACCESS_KEY_ID not set"
      echo "##vso[task.complete result=Failed;]"
    fi
  displayName: Assume role
  env:
    SRC_AWS_ACCESS_KEY_ID: ${{ parameters.src_aws_access_key_id }}
    SRC_AWS_SECRET_ACCESS_KEY: ${{ parameters.src_aws_secret_access_key }}
    EXTERNAL_ID: ${{ parameters.external_id }}