AWS CLI v2, Signature Checked Before Unpacking

aws-cli-v2

The AWS CLI v2 from the upstream zip, verified against the AWS CLI Team's OpenPGP key before a byte of it is unpacked, pinned to a version, with tab completion for every login shell. Original role for EL 10, live-tested with podman on Rocky Linux 10.

There is no package. EL 10 carries no awscli, and the v1 package that EPEL used to ship is gone. AWS distributes v2 as a zip plus a detached signature. Most installs run curl | unzip | ./aws/install and never look at the signature; this role downloads both files, checks the signature with gpg, and refuses to unpack on anything but "Good signature" from the expected fingerprint.

The key is pinned, and it lives in a GnuPG home of its own. The AWS CLI Team key (FB5D B77F D5C1 18B8 0511 ADA8 A631 0ACC 4672 475C, from the AWS CLI User Guide) ships with the role and is imported into /usr/local/src/aws-cli-gnupg, which holds nothing else - never into root's keyring. The role asserts the fingerprint before it trusts a verification, and the live test asserts that home holds exactly one key.

Pinned, and updated on purpose. aws_cli_v2_version is the version that gets installed; a newer one is a variable change and a run, not whatever latest happened to be that morning. Re-running with the same version is changed=0.

Proven to run, not just to exist. The live test calls sts get-caller-identity with no credentials and expects the CLI to get all the way to "Unable to locate credentials" - the binary, its bundled Python and its endpoint resolution all worked; only the credentials were missing.

License

Commercial - IaC Bazaar EULA. (c) IaC Bazaar.