AWS/CLI
From r00tedvw.com wiki
Quick Reference | AWS CLI | CloudFormation
Contents |
Installation (CentOS7)
Install EPEL
~$ sudo yum install -y epel-release sudo yum makecache
Find and install PIP
~$ sudo yum search pip | grep python3 python34-pip.noarch : A tool for installing and managing Python3 packages python36-pip.noarch : A tool for installing and managing Python3 packages ~$ sudo yum install -y python36-pip
Verify PIP
~$ pip3 -V pip 8.1.2 from/usr/lib/python3.6/site-packages (python 3.6)
Upgrade PIP
~$ sudo pip3 install --upgrade pip ~$ pip -V pip 19.1 from /usr/local/lib/python3.6/site-packages/pip (python 3.6)
Install AWS CLI
~$ $ pip search awscli | grep "awscli (" okta-awscli (0.4.0) - Provides a wrapper for Okta authentication to awscli awscli (1.16.145) - Universal Command Line Environment for AWS. ~$ pip install awscli --upgrade --user
Verify AWS CLI
~$ aws --version aws-cli/1.16.145 Python/3.6.6 Linux/3.10.0-957.10.1.el7.x86_64 botocore/1.12.135
Installation (MacOSX)
Make sure you have python 2.65+
~$ python --version Python 2.7.10
Download, unzip, and install via script.
~$ curl "https://s3.amazonaws.com/aws-cli/awscli-bundle.zip" -o "awscli-bundle.zip" ~$ unzip awscli-bundle.zip ~$ sudo ./awscli-bundle/install -i /usr/local/aws -b /usr/local/bin/aws
Credentials
Get your access and secret keys from:
- AWS Management Console > [click] username > [click] My Security Credentials
- [click] Create access key > [copy] Access Key ID > [click] Show secret access key > [copy] secret access key
- NOTE: you will never be able to access the secret access key again. Make sure you copy it, otherwise you'll have to create a new key.
Credentials for role user
Say you want to get an access and secret key for a role user that you can switch to:
- AWS Management Console > [click] services > [click] IAM under Security, Identity, & Compliance > [click] Users
- Add User > give them a user name > select "Programmatic access" for the Access type > for permissions I assigned "AdministratorAccess".
- [click] on the new user under Users > [click] Security Credentials tab > create access key > copy access and secret keys.
- NOTE: you will never be able to access the secret access key again. Make sure you copy it, otherwise you'll have to create a new key.
Setup Credentials AWS CLI
reference: https://blog.gruntwork.io/authenticating-to-aws-with-the-credentials-file-d16c0fbcbf9e
reference: https://blog.gruntwork.io/authenticating-to-aws-with-environment-variables-e793d6f6d02e
~$ aws configure AWS Access Key ID [none]: {access key} AWS Secret Access Key [none]: {secret key} Default region name [none]: {preferred region} Default output format [none]: {preferred output} ie. ~$ aws configure AWS Access Key ID [none]: ODH1748RKHR48892743 AWS Secret Access Key [none]: 48RJHJHD39739DHJHDUOHOI3719457DVMBNH Default region name [none]: us-east-1 Default output format [none]: json
This will save the info in:
- Credentials -
~/.aws/credentials
- Configuration -
~/.aws/config
Test your credentials by using a simple query to look at users in IAM.
~$ aws iam list-users
Assume Role
You will probably need to assume a role through the AWS CLI. Below is a script I wrote to help ease this process.
MAC OSX
#!/bin/bash #NOTE: on mac-osx use "source" to execute script instead of directly #make sure you configure $HOME/.aws/credentials with all of the aws_roles you list in the array below #ref: https://docs.aws.amazon.com/cli/latest/userguide/cli-configure-role.html#cli-configure-role-mfa #EXAMPLE: #[profile role-with-mfa] #region = us-west-2 #role_arn= arn:aws:iam::128716708097:role/cli-role #source_profile = cli-user #mfa_serial = arn:aws:iam::128716708097:mfa/cli-user tempjson="$HOME/assume-role-output.json" #aws_roles could be parsed from $HOME/.aws/credentials rather than hardcoded like is below. aws_roles=( roledisplayname\|arn:aws:iam::############:role/role-permission \ sandbox\|arn:aws:iam::123456789123:role/power-user ) function assume_role { echo "" echo "Select the role to impersonate, followed by [ENTER]:" for ((i=0;i<=(${#aws_roles[@]});i++)) do if (($i >= 1)); then echo $(echo -n "$i) "${aws_roles[i]} | awk -F '|' '{ print$1 }') fi done echo -n "Role #: " read role description=$(printf ${aws_roles[$role]} | awk -F '|' '{ print$1 }') arn=$(printf ${aws_roles[$role]} | awk -F '|' '{ print$2 }') echo "Backing up aws config and credential files" cp -f $HOME/.aws/config $HOME/.aws/config_backup && cp -f $HOME/.aws/credentials $HOME/.aws/credentials_backup #a temp file is used because each time you query aws it resets the keys. So when we tried to query aws for each variable, authentication failed because by the last variable, the first variable value had changed. echo "Assuming role: $description and getting the session" touch $tempjson aws sts assume-role --role-arn "$arn" --role-session-name "$description-session" --profile $description > $tempjson echo "Setting the AWS_ACCESS_KEY_ID to env var" export AWS_ACCESS_KEY_ID=$(jq -r '.Credentials.AccessKeyId' $tempjson) echo "Setting the AWS_SECRET_ACCESS_KEY to env var" export AWS_SECRET_ACCESS_KEY=$(jq -r '.Credentials.SecretAccessKey' $tempjson) echo "Setting the AWS_SESSION_TOKEN to env var" export AWS_SESSION_TOKEN=$(jq -r '.Credentials.SessionToken' $tempjson) export AWS_PROFILE="$description" } function remove_role { echo "" printf "Currently to remove the assumed role, you must exit the shell session.\nConfirm if you want to close your shell session [y/n]: " read close if [ $close = "y" ]; then echo "Unsetting environment variables to remove assumed role" unset AWS_ACCESS_KEY_ID && unset AWS_SECRET_ACCESS_KEY && unset AWS_SESSION_TOKEN echo "Assumed role removed" echo "Exitting shell" exit elif [ $close = "n" ]; then echo "Cancelling, current role will be maintained." else echo "Invalid selection. Try again." remove_role fi } function start { echo "" printf "1) Assume Role\n2) Remove Assumed Role\nSelect your choice, followed by [ENTER]: " read choice if (($choice == 1)); then assume_role elif (($choice == 2)); then remove_role else echo "Not a valid selection, try again" start fi } start