从正在运行的CLI Go程序更新AWS凭证以访问其他帐户

Question

Sorry if this is a very basic question, but I am new to AWS and have not found an answer in my research online. I am creating a CLI tool in Go that will pull down all the contents from an s3 bucket locally, then allow you to input new credentials, and then push those contents to a bucket in the new environment.

I am running into an issue where I am to input the new credentials. Here is the code:

type MyProvider struct{
    creds        credentials.Value
}

func getNewCredentials() {
    reader := bufio.NewReader(os.Stdin)
    fmt.Print("Copy new AWS Access Key: ")
    AK, _ := reader.ReadString('
')
    fmt.Print("Copy new AWS Secret Access Key: ")
    SAK, _ := reader.ReadString('
')
    fmt.Print("Copy new AWS session token: ")
    ST, _ := reader.ReadString('
')
    fmt.Print("New stage name(poc, dev, qa, prod): ")
    lib.Stage, _ = reader.ReadString('
')

    provider := MyProvider{
        creds: credentials.Value{AK, SAK, ST, ""},
    }

    creds := credentials.NewCredentials(&provider)

}

I am using a custom provider, and I have overwritten the provider functions Retrieve() and isExpired() (not shown in code snippet).

When I try and access the new bucket, it says the bucket does not exist, leading me to believe the credentials did not properly update. My guess is this has to do with the blank providername at the end of the Value struct. I am not sure what to put there.

Any guidance on how to fix this would be very helpful. The program is not throwing any errors, but rather just not actually updating the credentials.

Answer 1

https://docs.aws.amazon.com/sdk-for-go/v1/developer-guide/configuring-sdk.html#specifying-credentials suggests that you instantiate like this :

sess, err := session.NewSession(&aws.Config{
    Region:      aws.String("us-west-2"),
    Credentials: credentials.NewStaticCredentials("AKID", "SECRET_KEY", "TOKEN"),
})

If I were trying to do this, I would have the accounts share a trust relationship by allowing one to assume a role in the other, rather than passing credentials.

https://docs.aws.amazon.com/IAM/latest/UserGuide/tutorial_cross-account-with-roles.html

It's wonderfully convenient in go:

https://docs.aws.amazon.com/sdk-for-go/api/aws/credentials/stscreds/