get-microvm-token.sh

#!/usr/bin/env zsh
# =============================================================================
# get-microvm-token.sh
#
# Fetch a short-lived auth token for an existing MicroVM and write it to a
# sourceable env file. Mirrors the convention used by deploy-microvm.sh /
# run-microvm.sh — we can't mutate the caller's environment from a
# subprocess, so we write `export MICROVM_TOKEN=...` lines into a file and
# tell the user to source it.
#
# Usage:
#   ./get-microvm-token.sh <microvm-id> [expiration-minutes]
#
# Example:
#   ./get-microvm-token.sh microvm-74c4447e-c05c-31a5-b310-67af45a34d79
#   source .microvm-token.microvm-74c4447e-c05c-31a5-b310-67af45a34d79
#   curl -H "X-aws-proxy-auth: $MICROVM_TOKEN" ...
#
# Config via env (defaults match deploy-microvm.sh / run-microvm.sh):
#   REGION              default: us-east-2
#   EXPIRATION_MINUTES  default: 30   (positional arg overrides this)
#   APP_PORT            default: 8080 (X-aws-proxy-port hint; also the port
#                                      the token's --allowed-ports grants
#                                      access to)
#
# Requires `awsv` (AWS CLI v2 alias from ~/.zshrc) and `jq`. The
# lambda-microvms service is built into AWS CLI v2 (GA) — no
# `aws configure add-model` step needed.
# =============================================================================

MICROVM_ID="${1:?Usage: $0 <microvm-id> [expiration-minutes]}"
EXPIRATION_MINUTES="${2:-${EXPIRATION_MINUTES:-30}}"

# Pick up `awsv` from the user's shell config — same trick deploy-microvm.sh uses.
[[ -f "$HOME/.zshrc" ]] && source "$HOME/.zshrc"

if ! whence -w awsv >/dev/null 2>&1; then
  print -u2 "ERROR: 'awsv' is not defined after sourcing ~/.zshrc."
  print -u2 "       Define it in ~/.zshenv so non-interactive shells see it."
  exit 1
fi
if ! command -v jq >/dev/null 2>&1; then
  print -u2 "ERROR: 'jq' is required to parse the multi-part authToken response."
  print -u2 "       Install with: brew install jq"
  exit 1
fi

set -euo pipefail

REGION="${REGION:-us-east-2}"
APP_PORT="${APP_PORT:-8080}"

SCRIPT_DIR="$(cd -- "$(dirname -- "$0")" && pwd)"

AWS_ARGS=(--region "$REGION")

# -- Call the API --------------------------------------------------------------
# Schema: CreateMicrovmAuthTokenResponse.authToken is a map<AuthTokenKey,
# AuthTokenValue> ("TokenParts"), max 10 entries. Today there's exactly one
# entry — "X-aws-proxy-auth" — but the schema allows multiple, so we keep
# the full map in the token file as a comment for forensic / future use.
AUTH_JSON=$(awsv aws lambda-microvms create-microvm-auth-token \
  --microvm-identifier "$MICROVM_ID" \
  --expiration-in-minutes "$EXPIRATION_MINUTES" \
  --allowed-ports '[{"port":'"$APP_PORT"'}]' \
  "${AWS_ARGS[@]}" \
  --output json)

AUTH_TOKEN_MAP=$(print -r -- "$AUTH_JSON" | jq -c '.authToken')

# Pick the token part by exact key name. `-e` makes jq exit non-zero on null
# (so a renamed/missing key fails loudly instead of silently exporting "null").
MICROVM_TOKEN=$(print -r -- "$AUTH_TOKEN_MAP" | jq -er '."X-aws-proxy-auth"')

# Token file lives in the repo root, keyed by MicroVM id (not image name) so
# multiple VMs from the same image don't clobber each other.
TOKEN_FILE="$SCRIPT_DIR/.microvm-token.$MICROVM_ID"
umask 077
{
  printf '# Generated by get-microvm-token.sh on %s\n' "$(date)"
  printf '# MicroVM: %s   Expires in: %s minutes\n' "$MICROVM_ID" "$EXPIRATION_MINUTES"
  printf '# Full authToken payload (for reference): %s\n' "$AUTH_TOKEN_MAP"
  printf 'export MICROVM_ID=%q\n'    "$MICROVM_ID"
  printf 'export MICROVM_TOKEN=%q\n' "$MICROVM_TOKEN"
  printf 'export APP_PORT=%q\n'      "$APP_PORT"
} > "$TOKEN_FILE"
chmod 600 "$TOKEN_FILE"

print "Wrote $TOKEN_FILE"
print "MICROVM_TOKEN: ${MICROVM_TOKEN:0:8}…   (${EXPIRATION_MINUTES}-min expiry)"
print ""
print "To load into your current shell, run:"
print "  source $TOKEN_FILE"