#!/bin/sh
# IAM Policy Autopilot Installation Script
#
# This script automatically downloads and installs the IAM Policy Autopilot CLI tool
# for Unix-like systems (macOS and Linux).
#
# Supported platforms:
# - macOS (Darwin): x86_64, ARM64
# - Linux: x86_64, ARM64
#
# Usage:
# # Fresh installation (one-liner):
# curl -sSL https://github.com/awslabs/iam-policy-autopilot/raw/refs/heads/main/install.sh | sh
#
# # Update existing installation (same command):
# curl -sSL https://github.com/awslabs/iam-policy-autopilot/raw/refs/heads/main/install.sh | sh
#
# # Manual installation with sudo:
# curl -sSL https://github.com/awslabs/iam-policy-autopilot/raw/refs/heads/main/install.sh | sudo sh
#
# # Download and run locally:
# curl -sSL https://github.com/awslabs/iam-policy-autopilot/raw/refs/heads/main/install.sh -o install.sh
# chmod +x install.sh
# ./install.sh
#
# The script will automatically detect if you have an existing installation and update it
# if a newer version is available. If you're already running the latest version, it will
# notify you and exit without making changes.
# Repository configuration
GITHUB_ORG="awslabs"
GITHUB_REPO="iam-policy-autopilot"
set -e
# Global variables for cleanup
TEMP_FILE=""
TEMP_DIR=""
# Cleanup function
cleanup() {
if [ -n "$TEMP_FILE" ] && [ -f "$TEMP_FILE" ]; then
rm -f "$TEMP_FILE"
fi
if [ -n "$TEMP_DIR" ] && [ -d "$TEMP_DIR" ]; then
rm -rf "$TEMP_DIR"
fi
}
# Set up cleanup trap for temporary files
trap cleanup EXIT INT TERM
# Error handling function
error() {
echo "Error: $1" >&2
cleanup
exit 1
}
# Platform detection function
detect_platform() {
echo "Detecting platform..."
# Detect OS
OS=$(uname -s | tr '[:upper:]' '[:lower:]')
case "$OS" in
darwin)
OS="apple-darwin"
;;
linux)
OS="unknown-linux-gnu"
;;
*)
error "Unsupported operating system: $OS. Supported: macOS (Darwin), Linux"
;;
esac
# Detect architecture
ARCH=$(uname -m)
case "$ARCH" in
x86_64)
# Keep as is
;;
aarch64|arm64)
ARCH="aarch64"
;;
i686|i386)
error "32-bit x86 architecture is not supported. Supported: x86_64, ARM64"
;;
*)
error "Unsupported architecture: $ARCH. Supported: x86_64, ARM64"
;;
esac
# Construct platform target triple
PLATFORM="${ARCH}-${OS}"
echo "Detected platform: $PLATFORM"
}
# GitHub API integration function
get_latest_release() {
echo "Fetching latest release information from GitHub..."
# Query GitHub API for latest release
RELEASE_JSON=$(curl -sL \
-H "Accept: application/vnd.github+json" \
-H "X-GitHub-Api-Version: 2022-11-28" \
"https://api.github.com/repos/$GITHUB_ORG/$GITHUB_REPO/releases/latest" 2>&1)
# Check if curl command succeeded
if [ $? -ne 0 ]; then
error "Failed to fetch release information from GitHub. Please check your internet connection and try again."
fi
# Check if response contains error
if echo "$RELEASE_JSON" | grep -q '"message".*"Not Found"'; then
error "GitHub repository or release not found. Please verify the repository exists."
fi
if echo "$RELEASE_JSON" | grep -q '"message".*"API rate limit exceeded"'; then
error "GitHub API rate limit exceeded. Please try again later."
fi
# Extract version tag
VERSION=$(echo "$RELEASE_JSON" | grep '"tag_name"' | sed -E 's/.*"tag_name"[[:space:]]*:[[:space:]]*"([^"]+)".*/\1/' | head -n 1)
if [ -z "$VERSION" ]; then
error "Failed to parse version from GitHub API response. The response may be malformed."
fi
echo "Latest version: $VERSION"
# Find matching binary asset based on platform
# Look for assets that contain the platform string in their name
ASSET_URL=$(echo "$RELEASE_JSON" | grep '"browser_download_url"' | grep "$PLATFORM" | sed -E 's/.*"browser_download_url"[[:space:]]*:[[:space:]]*"([^"]+)".*/\1/' | head -n 1)
if [ -z "$ASSET_URL" ]; then
error "No binary found for platform: $PLATFORM. This platform may not be supported yet. Please report this at https://github.com/$GITHUB_ORG/$GITHUB_REPO/issues"
fi
# Extract asset filename from URL
ASSET_NAME=$(basename "$ASSET_URL")
echo "Found binary: $ASSET_NAME"
echo "Download URL: $ASSET_URL"
}
# Version comparison function
check_existing_version() {
INSTALL_DIR="/usr/local/bin"
BINARY_PATH="$INSTALL_DIR/iam-policy-autopilot"
echo "Checking for existing installation..."
# Check if binary exists in installation directory
if [ -f "$BINARY_PATH" ]; then
echo "Found existing installation at $BINARY_PATH"
# Try to get installed version by executing --version command
INSTALLED_VERSION=$("$BINARY_PATH" --version 2>/dev/null | awk '{print $2}')
# If version detection failed, proceed with installation
if [ -z "$INSTALLED_VERSION" ]; then
echo "Could not determine installed version. Proceeding with installation."
return 0
fi
echo "Installed version: $INSTALLED_VERSION"
# Remove 'v' prefix from VERSION if present for comparison
LATEST_VERSION_CLEAN="${VERSION#v}"
# Compare installed version with latest release version
if [ "$INSTALLED_VERSION" = "$LATEST_VERSION_CLEAN" ]; then
echo ""
echo "iam-policy-autopilot $INSTALLED_VERSION is already installed and up-to-date"
exit 0
fi
echo "Updating iam-policy-autopilot from $INSTALLED_VERSION to $LATEST_VERSION_CLEAN"
else
echo "No existing installation found"
echo "Installing iam-policy-autopilot ${VERSION#v}"
fi
}
# Download binary function
download_binary() {
echo ""
echo "Downloading binary..."
# Create temporary file for download
TEMP_FILE=$(mktemp)
echo "Downloading from $ASSET_URL"
# Try curl first, fallback to wget
if command -v curl >/dev/null 2>&1; then
# Use curl with progress bar
if ! curl -L --progress-bar -o "$TEMP_FILE" "$ASSET_URL"; then
error "Failed to download binary using curl. Please check your internet connection and try again."
fi
elif command -v wget >/dev/null 2>&1; then
# Use wget with progress display
if ! wget -q --show-progress -O "$TEMP_FILE" "$ASSET_URL"; then
error "Failed to download binary using wget. Please check your internet connection and try again."
fi
else
error "Neither curl nor wget found. Please install curl or wget and try again."
fi
# Verify download succeeded by checking file size
if [ ! -s "$TEMP_FILE" ]; then
error "Downloaded file appears to be empty or corrupted. Please try again."
fi
echo "Download complete"
# Handle archived formats
# Check if the downloaded file is a tar.gz archive
if echo "$ASSET_NAME" | grep -q "\.tar\.gz$"; then
echo "Extracting tar.gz archive..."
# Create temporary directory for extraction
TEMP_DIR=$(mktemp -d)
# Extract archive
if ! tar -xzf "$TEMP_FILE" -C "$TEMP_DIR"; then
error "Failed to extract tar.gz archive. The file may be corrupted."
fi
# Find the binary in the extracted files
# Look for file named iam-policy-autopilot (without extension)
EXTRACTED_BINARY=$(find "$TEMP_DIR" -type f -name "iam-policy-autopilot" | head -n 1)
if [ -z "$EXTRACTED_BINARY" ]; then
error "Could not find iam-policy-autopilot binary in extracted archive."
fi
# Move extracted binary to temp file location
mv "$EXTRACTED_BINARY" "$TEMP_FILE"
# Clean up extraction directory
rm -rf "$TEMP_DIR"
echo "Extraction complete"
elif echo "$ASSET_NAME" | grep -q "\.zip$"; then
echo "Extracting zip archive..."
# Create temporary directory for extraction
TEMP_DIR=$(mktemp -d)
# Check if unzip is available
if ! command -v unzip >/dev/null 2>&1; then
error "unzip command not found. Please install unzip to extract .zip archives."
fi
# Extract archive
if ! unzip -q "$TEMP_FILE" -d "$TEMP_DIR"; then
error "Failed to extract zip archive. The file may be corrupted."
fi
# Find the binary in the extracted files
EXTRACTED_BINARY=$(find "$TEMP_DIR" -type f -name "iam-policy-autopilot" | head -n 1)
if [ -z "$EXTRACTED_BINARY" ]; then
error "Could not find iam-policy-autopilot binary in extracted archive."
fi
# Move extracted binary to temp file location
mv "$EXTRACTED_BINARY" "$TEMP_FILE"
# Clean up extraction directory
rm -rf "$TEMP_DIR"
echo "Extraction complete"
fi
# Verify the final binary file exists and is not empty
if [ ! -s "$TEMP_FILE" ]; then
error "Binary file is missing or empty after processing. Please try again."
fi
echo "Binary ready for installation"
}
# Installation function
install_binary() {
INSTALL_DIR="/usr/local/bin"
BINARY_NAME="iam-policy-autopilot"
INSTALL_PATH="$INSTALL_DIR/$BINARY_NAME"
echo ""
echo "Installing binary..."
# Check write permissions for installation directory
if [ ! -w "$INSTALL_DIR" ]; then
error "No write permission to $INSTALL_DIR. Try running with sudo: curl -sSL https://github.com/$GITHUB_ORG/$GITHUB_REPO/raw/refs/heads/main/install.sh | sudo sh"
fi
# Preserve permissions when updating existing installation
# If binary already exists, save its permissions
EXISTING_PERMS=""
if [ -f "$INSTALL_PATH" ]; then
# Get current permissions in octal format (e.g., 755)
EXISTING_PERMS=$(stat -f "%Lp" "$INSTALL_PATH" 2>/dev/null || stat -c "%a" "$INSTALL_PATH" 2>/dev/null)
echo "Preserving existing permissions: $EXISTING_PERMS"
fi
# Move downloaded binary to installation directory
if ! mv "$TEMP_FILE" "$INSTALL_PATH"; then
error "Failed to move binary to $INSTALL_PATH. Please check permissions and try again."
fi
# Set executable permissions
# If we preserved permissions from existing installation, restore them
# Otherwise, set default executable permissions (755)
if [ -n "$EXISTING_PERMS" ]; then
chmod "$EXISTING_PERMS" "$INSTALL_PATH"
else
chmod +x "$INSTALL_PATH"
fi
# Get the installed version for success message
FINAL_VERSION=$("$INSTALL_PATH" --version 2>/dev/null | awk '{print $2}' || echo "${VERSION#v}")
echo ""
echo "=========================================="
echo "Installation complete!"
echo "=========================================="
echo "Version: $FINAL_VERSION"
echo "Location: $INSTALL_PATH"
echo ""
echo "Run 'iam-policy-autopilot --help' to get started"
}
# Main execution
main() {
detect_platform
get_latest_release
check_existing_version
download_binary
install_binary
}
main
