Cloud Authentication via CLI - SethBodine/audit-tools GitHub Wiki
Paths of configuration files differ within OS, and will only be located once these files are created manually or automatically via aws configure
~/.aws
%USERPROFILE%\.aws\
File Names | Use |
---|---|
config | Region and Output format |
credentials | Update [default] as required - this may require 3 entries AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY, and AWS_SESSION_TOKEN |
The AWS Account needs to be set-up with Access Key and Secret Key, if MFA is configured, it will be configured with a Virtual MFA Device. This ARN can be found in your IAM Account.
aws configure # May not be required
aws sts get-session-token --serial-number arn:aws:iam::<accountnumber>:mfa/<username> --token-code <6 Digit Code>
aws configure # Update Secret and Key
aws configure set aws_session_token <SESSION_TOKEN_HERE> # Add temporary Session Token
aws iam generate-credential-report # Generates IAM Credential Report
This approach is not advised
aws configure # Update Secret and Key
aws iam generate-credential-report # Generates IAM Credential Report
Roles can be created as additional profiles in the credentials file
- Confirm the AWS Account Number, and the Name of the Role to use
- Edit the credentials file and create a new profile as such:
[<profile name>]
role_arn = arn:aws:iam::<account number>:role/<Role Name>
source_profile = default
Note: the above example references the default profile, and can be changed as required, it should reference the Org Profile though.
- create an IAM credential report
aws iam generate-credential-report --profile <newly created profile name> # Generates IAM Credential Report
More information can be found here
If your client supports Modern Auth and can instigate a browser session this is the ideal approach
az login
If your client does not support, or fails to launch a browser session, you may be asked to navigate to a URL and provide a Code to Authenticate
az login --use-device-code
gcloud auth application-default login --no-launch-browser
gcloud projects list
gcloud config set project [PROJECT_ID]