Security News
Research
Data Theft Repackaged: A Case Study in Malicious Wrapper Packages on npm
The Socket Research Team breaks down a malicious wrapper package that uses obfuscation to harvest credentials and exfiltrate sensitive data.
IMPORTANT: This tool is deprecated. Please use the new tool available at: https://cloud.docs.zalando.net/reference/zaws/
This package previously provided the zaws
command line utility. It now serves as a transition to the new tool.
package provides the zaws
command line utility to exchange OAuth tokens for temporary AWS credentials by calling the AWS Credentials Service
_.
Installing or updating this package will provide information about migrating to the new tool.
The zalando-aws-cli
package is part of the stups
bundle:
.. code-block:: bash
$ sudo pip3 install -U stups
$ stups configure
.. code-block:: bash
$ zaws list # list all allowed account roles
$ zaws login myacc RoleName # write ~/.aws/credentials
You can configure your default account/role to only run zaws
:
.. code-block:: bash
$ zaws set-default myacc RoleName
$ zaws
There are multiple ways of abbreviating the command line:
.. code-block:: bash
$ zaws li # command can be abbreviated
$ zaws login myacc # only the account name is needed if you have only one role
$ zaws alias myalias myacc PowerUser # create an alias
$ zaws lo myalias # use the alias
Use -h
to get a list of commands and help:
.. code-block:: bash
$ zaws -h # list top-level commands
$ zaws login -h # help on the "login" command
You can run the module directly during development:
.. code-block:: bash
$ python3 -m zalando_aws_cli list
$ python3 -m zalando_aws_cli login myacc PowerUser
.. code-block:: bash
$ sudo pip3 install tox
$ tox
.. _AWS Credentials Service: https://github.com/zalando-incubator/aws-credentials-service
FAQs
AWS login CLI
We found that zalando-aws-cli demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 3 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
Research
The Socket Research Team breaks down a malicious wrapper package that uses obfuscation to harvest credentials and exfiltrate sensitive data.
Research
Security News
Attackers used a malicious npm package typosquatting a popular ESLint plugin to steal sensitive data, execute commands, and exploit developer systems.
Security News
The Ultralytics' PyPI Package was compromised four times in one weekend through GitHub Actions cache poisoning and failure to rotate previously compromised API tokens.