How-to configure AWS config credential_process + op?

Hey @yodakramer ! Thank you for reaching out to us.

To zoom out a little, can you please let us know what the structure of your item is (with the sensitive values redacted, of course) and what the desired structure of the credential_process should be?

Looking forward to hearing from you.

Best,
Horia

Thanks. I have used the examples from this blog post, https://kfalck.net/2018/03/18/storing-aws-cli-credentials-in-1password/.

The output from op looks like this:
```
{
"Version": 1,
"AccessKeyId": "MYKEY",
"SecretAccessKey": "MYSECRETKEY"
}

```
And the entry looks like this:

Ah, gotcha, thanks for clarifying! A more native way for achieving this in CLI2 would be along the lines of:

credential_process = "{ \"Version\": 1, \"AccessKeyId\": \"$(op read op://yourvault/aws/aws_access_key_id)\", \"SecretAccessKey\": \"$(op read op://yourvault/aws/aws_secret_access_key)\" }"


Let us know if this works for you, otherwise we can look into further options to adapt your v1 script.
Looking forward to hearing from you, and thank you, once again, for giving v2 a try! :D

Best,
Horia

I had to make changes to your version to match what credential_process expects.


credential_process = sh -c 'echo "{\n \"Version\": 1,\n \"AccessKeyId\": \"$(op read op://MyVault/aws-staging/CREDENTIALS/aws_access_key_id)\",\n \"SecretAccessKey\": \"$(op read op://MyVault/aws-staging/CREDENTIALS/aws_secret_access_key)\"\n}" '

The AWS CLI expects a multi-line JSON return, so I added \n where needed and needed to be exec'd with -c passed to the shell.

This works quite well now!

Glad you got it working!! Let us know if we can help with anything else.

Best,
Horia

Here's an updated jq method, to launch op once:


credential_process = sh -c "op --account=... --vault=... item get --format=json --fields=label=AccessKeyId,label=SecretAccessKey ... | jq 'map({key: .label, value: .value}) | from_entries + {Version: 1}'"


Thanks for the feedback!