Cloud CLIs

Functions of the tools module at v0.3.2. Each returns what a command runs in; import it with import * as tools from "tools".

aws

The AWS CLI v2, configured by its parameters.

aws(
  --image: Environment = #amazon/aws-cli:2.36.41,
  --profile: String | Null = null,
  --region: String | Null = null,
  --endpoint_url: String | Null = null,
  --access_key_id: String | Null = null,
  --secret_access_key: String | Null = <secret>,
  --session_token: String | Null = <secret>,
  --config_dir: String | Null = null,
  --with: Array<Record<env: Map<String>, volumes: Array<String>>> = [],
  --extra_env: Map<String> = {}
): Runnable

The image is #amazon/aws-cli:2.36.41 unless --image names another. lask sync pulls and pins whichever image is used (lask spec 10.3); a run never pulls.

Locally, log in on the host (aws sso login) and mount the result with config_dir = home(".aws"); the mount is read-only, so an expired token fails rather than being refreshed, and the fix is to log in again on the host. In CI, pass the three credentials instead. A container sees no variable of the host unless it is given here.

The pager is off by default (AWS_PAGER=""), so output is never held behind less; --extra_env can turn it back on.

Parameters

• --image The image to run; another release is passed as image = #amazon/aws-cli:<tag>.
• --profile AWS_PROFILE: a profile from the config directory.
• --region AWS_REGION and AWS_DEFAULT_REGION.
• --endpoint_url AWS_ENDPOINT_URL, for LocalStack or another AWS-compatible endpoint.
• --access_key_id AWS_ACCESS_KEY_ID.
• --secret_access_key!! AWS_SECRET_ACCESS_KEY; masked in the command log.
• --session_token!! AWS_SESSION_TOKEN; masked in the command log.
• --config_dir Host directory mounted read-only as /root/.aws, usually home(".aws").
• --with Setups of other tools this environment should also carry.
• --extra_env Any other variable; below --with and the named parameters.

Returns Runnable: The environment, for command { "aws" } on ... or $[...].

Image amazon/aws-cli:2.36.41

lask eval aws --profile dev --region ap-northeast-1

lib/aws.lask

gcloud

The Google Cloud CLI (gcloud, gsutil, bq), configured by its parameters.

gcloud(
  --image: Environment = #gcr.io/google.com/cloudsdktool/google-cloud-cli:586.0.0-slim,
  --project: String | Null = null,
  --region: String | Null = null,
  --credentials_file: String | Null = null,
  --access_token: String | Null = <secret>,
  --config_dir: String | Null = null,
  --with: Array<Record<env: Map<String>, volumes: Array<String>>> = [],
  --extra_env: Map<String> = {}
): Runnable

The image is #gcr.io/google.com/cloudsdktool/google-cloud-cli:586.0.0-slim unless --image names another; the Docker Hub copy, google/cloud-sdk, is published for amd64 only. lask sync pulls and pins whichever image is used (lask spec 10.3); a run never pulls.

gcloud never prompts (CLOUDSDK_CORE_DISABLE_PROMPTS=1). Locally, log in on the host (gcloud auth login, gcloud auth application-default login) and pass config_dir = home(".config/gcloud"). In CI, pass a credentials file or an access token.

Parameters

• --image The image to run; another release is passed as image = #gcr.io/google.com/cloudsdktool/google-cloud-cli:<tag>.
• --project CLOUDSDK_CORE_PROJECT and GOOGLE_CLOUD_PROJECT.
• --region CLOUDSDK_COMPUTE_REGION and GOOGLE_REGION.
• --credentials_file Host path of a credentials file, mounted read-only.
• --access_token!! CLOUDSDK_AUTH_ACCESS_TOKEN and GOOGLE_OAUTH_ACCESS_TOKEN; masked in the command log.
• --config_dir Host directory mounted as /root/.config/gcloud.
• --with Setups of other tools this environment should also carry.
• --extra_env Any other variable; below --with and the named parameters.

Returns Runnable: The environment, for command { "gcloud" } on ... or $[...].

Image gcr.io/google.com/cloudsdktool/google-cloud-cli:586.0.0-slim

lask eval gcloud --project my-project --region asia-northeast1

lib/gcloud.lask

az

The Azure CLI, configured by its parameters.

az(
  --image: Environment = #mcr.microsoft.com/azure-cli:2.90.0,
  --subscription_id: String | Null = null,
  --tenant_id: String | Null = null,
  --client_id: String | Null = null,
  --client_secret: String | Null = <secret>,
  --config_dir: String | Null = null,
  --with: Array<Record<env: Map<String>, volumes: Array<String>>> = [],
  --extra_env: Map<String> = {}
): Runnable

The image is #mcr.microsoft.com/azure-cli:2.90.0 unless --image names another. lask sync pulls and pins whichever image is used (lask spec 10.3); a run never pulls.

Telemetry is off (AZURE_CORE_COLLECT_TELEMETRY=false). Locally, log in on the host (az login) and pass config_dir = home(".azure"). az does not log in from variables by itself: in CI, pass the service principal and start the command with az login --service-principal -u "$AZURE_CLIENT_ID" -p "$AZURE_CLIENT_SECRET" --tenant "$AZURE_TENANT_ID".

Parameters

• --image The image to run; another release is passed as image = #mcr.microsoft.com/azure-cli:<tag>.
• --subscription_id ARM_SUBSCRIPTION_ID and AZURE_SUBSCRIPTION_ID.
• --tenant_id ARM_TENANT_ID and AZURE_TENANT_ID.
• --client_id ARM_CLIENT_ID and AZURE_CLIENT_ID.
• --client_secret!! ARM_CLIENT_SECRET and AZURE_CLIENT_SECRET; masked in the command log.
• --config_dir Host directory mounted as /root/.azure.
• --with Setups of other tools this environment should also carry.
• --extra_env Any other variable; below --with and the named parameters.

Returns Runnable: The environment, for command { "az" } on ... or $[...].

Image mcr.microsoft.com/azure-cli:2.90.0

lask eval az --subscription_id 00000000-0000-0000-0000-000000000000

lib/azure.lask