with-assumed-role

#!/usr/bin/env sh
set -eu

SILENT=true

if [ "x$1" = "x-v" ]
then
    SILENT=false
    shift
fi

ROLE_ARN="$1"; shift
aws sts assume-role \
    --role-arn "${ROLE_ARN}" \
    --role-session-name=docsite-uploader \
    --output json >/tmp/assume-role.json

cat /tmp/assume-role.json | \
    jq '{
      AWS_ACCESS_KEY_ID: .Credentials.AccessKeyId,
      AWS_SECRET_ACCESS_KEY: .Credentials.SecretAccessKey,
      AWS_SESSION_TOKEN: .Credentials.SessionToken
      } | to_entries | map("\(.key)=\(.value|tostring)")|.[]' -r >/tmp/assume-role.sh

. /tmp/assume-role.sh
export AWS_ACCESS_KEY_ID
export AWS_SECRET_ACCESS_KEY
export AWS_SESSION_TOKEN

"${SILENT}" || echo "AWS identity is '$(aws sts get-caller-identity --output text --query 'Arn')'"

command="$1"; shift
exec "${command}" ${1+"$@"}