[v12] Allow a tsh aws to proxy any command (#19941)

tool/tsh/app_aws.go

@@ -65,7 +65,12 @@ func onAWS(cf *CLIConf) error {
 		args = append(args, "--endpoint-url", awsApp.GetEndpointURL())
 	}
 
-	cmd := exec.Command(awsCLIBinaryName, args...)
+	commandToRun := awsCLIBinaryName
+	if cf.Exec != "" {
+		commandToRun = cf.Exec
+	}
+
+	cmd := exec.Command(commandToRun, args...)
 	return awsApp.RunCommand(cmd)
 }
 

tool/tsh/app_aws_test.go

@@ -111,6 +111,21 @@ func TestAWS(t *testing.T) {
 		setCmdRunner(validateCmd),
 	)
 	require.NoError(t, err)
+
+	validateCmd = func(cmd *exec.Cmd) error {
+		// Validate composed AWS CLI command.
+		require.Len(t, cmd.Args, 2)
+		require.Equal(t, []string{"terraform", "plan"}, cmd.Args[:2])
+
+		return nil
+	}
+	err = Run(
+		context.Background(),
+		[]string{"aws", "--app", "aws-app", "--exec", "terraform", "plan"},
+		setHomePath(tmpHomePath),
+		setCmdRunner(validateCmd),
+	)
+	require.NoError(t, err)
 }
 
 func makeUserWithAWSRole(t *testing.T) (types.User, types.Role) {

tool/tsh/tsh.go

@@ -343,6 +343,8 @@ type CLIConf struct {
 	// LocalProxyTunnel specifies whether local proxy will open auth'd tunnel.
 	LocalProxyTunnel bool
 
+	// Exec is the command to run via tsh aws.
+	Exec string
 	// AWSRole is Amazon Role ARN or role name that will be used for AWS CLI access.
 	AWSRole string
 	// AWSCommandArgs contains arguments that will be forwarded to AWS CLI binary.
@@ -661,6 +663,7 @@ func Run(ctx context.Context, args []string, opts ...cliOption) error {
 	aws.Flag("app", "Optional Name of the AWS application to use if logged into multiple.").StringVar(&cf.AppName)
 	aws.Flag("endpoint-url", "Run local proxy to serve as an AWS endpoint URL. If not specified, local proxy serves as an HTTPS proxy.").
 		Short('e').Hidden().BoolVar(&cf.AWSEndpointURLMode)
+	aws.Flag("exec", "Execute different commands (e.g. terraform) under Teleport credentials").StringVar(&cf.Exec)
 
 	azure := app.Command("az", "Access Azure API.").Interspersed(false)
 	azure.Arg("command", "`az` command and subcommands arguments that are going to be forwarded to Azure CLI.").StringsVar(&cf.AzureCommandArgs)