4 files changed, 106 insertions, 0 deletions
diff --git a/roles/awscli/defaults/main.yml b/roles/awscli/defaults/main.yml
new file mode 100644
index 00000000..166b6c53
--- /dev/null
+++ b/roles/awscli/defaults/main.yml
@@ -0,0 +1,2 @@
+---
+awscli_version: "latest"
diff --git a/roles/awscli/meta/argument_specs.yml b/roles/awscli/meta/argument_specs.yml
new file mode 100644
index 00000000..3fe2358c
--- /dev/null
+++ b/roles/awscli/meta/argument_specs.yml
@@ -0,0 +1,32 @@
+---
+argument_specs:
+  main:
+    options:
+      awscli_version:
+        type: "str"
+        description: "aws-cli version to install via mise (e.g. 'latest', '2.19.0')"
+        default: "latest"
+      awscli_profile_name:
+        type: "str"
+        description: >-
+          AWS CLI profile name to configure. Use "default" to make it the
+          profile used when --profile is omitted
+        required: true
+      awscli_access_key_id:
+        type: "str"
+        description: "Access key ID for this profile"
+        required: true
+      awscli_secret_access_key:
+        type: "str"
+        description: "Secret access key for this profile"
+        required: true
+      awscli_region:
+        type: "str"
+        description: "Region for this profile (e.g. garage's configured s3_region for a garage profile)"
+        required: true
+      awscli_endpoint_url:
+        type: "str"
+        description: >-
+          Custom S3 endpoint URL for this profile, Omit for real AWS
+          (e.g. http://127.0.0.1:3900 for garage).
+        required: false
diff --git a/roles/awscli/meta/main.yml b/roles/awscli/meta/main.yml
new file mode 100644
index 00000000..7667b31b
--- /dev/null
+++ b/roles/awscli/meta/main.yml
@@ -0,0 +1,18 @@
+---
+dependencies:
+  - role: "mise"
+galaxy_info:
+  author: "a14m"
+  description: "Install and configure aws-cli via mise"
+  license: "MIT"
+  min_ansible_version: "2.18"
+  platforms:
+    - name: "ArchLinux"
+      versions:
+        - "all"
+    - name: "Ubuntu"
+      versions:
+        - "noble"
+    - name: "Debian"
+      versions:
+        - "bookworm"
diff --git a/roles/awscli/tasks/main.yml b/roles/awscli/tasks/main.yml
new file mode 100644
index 00000000..b28747a4
--- /dev/null
+++ b/roles/awscli/tasks/main.yml
@@ -0,0 +1,54 @@
+---
+- name: "Check installed aws-cli versions"
+  ansible.builtin.command:
+    cmd: "mise ls aws-cli"
+  register: awscli_installed_versions
+  changed_when: false
+
+- name: "Install aws-cli"
+  ansible.builtin.command:
+    cmd: "mise use --global aws-cli@{{ awscli_version }}"
+  changed_when: true
+  when: awscli_version not in awscli_installed_versions.stdout
+
+- name: "Ensure .aws directory exists"
+  ansible.builtin.file:
+    path: "{{ ansible_facts['env']['HOME'] }}/.aws"
+    state: "directory"
+    mode: "0700"
+
+# AWS CLI's config file uses "[default]" for the default profile but
+# "[profile <name>]" for every other named profile - credentials file has
+# no such special case, it's always "[<name>]".
+- name: "Determine aws-cli config section name"
+  ansible.builtin.set_fact:
+    awscli_config_section: "{{ 'default' if awscli_profile_name == 'default' else 'profile ' + awscli_profile_name }}"
+
+- name: "Configure aws-cli credentials"
+  community.general.ini_file:
+    path: "{{ ansible_facts['env']['HOME'] }}/.aws/credentials"
+    section: "{{ awscli_profile_name }}"
+    option: "{{ item.key }}"
+    value: "{{ item.value }}"
+    mode: "0600"
+  loop:
+    - { key: "aws_access_key_id", value: "{{ awscli_access_key_id }}" }
+    - { key: "aws_secret_access_key", value: "{{ awscli_secret_access_key }}" }
+  no_log: true
+
+- name: "Configure aws-cli profile region"
+  community.general.ini_file:
+    path: "{{ ansible_facts['env']['HOME'] }}/.aws/config"
+    section: "{{ awscli_config_section }}"
+    option: "region"
+    value: "{{ awscli_region }}"
+    mode: "0600"
+
+- name: "Configure aws-cli profile endpoint URL"
+  community.general.ini_file:
+    path: "{{ ansible_facts['env']['HOME'] }}/.aws/config"
+    section: "{{ awscli_config_section }}"
+    option: "endpoint_url"
+    value: "{{ awscli_endpoint_url }}"
+    mode: "0600"
+  when: awscli_endpoint_url is defined