Cloud Authentication via CLI - SethBodine/audit-tools GitHub Wiki

Authentication Commands via CLI

AWS

Paths of configuration files differ within OS, and will only be located once these files are created manually or automatically via aws configure

*nux

~/.aws

Windows

%USERPROFILE%\.aws\

Files

File Names Use
config Region and Output format
credentials Update [default] as required - this may require 3 entries AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY, and AWS_SESSION_TOKEN

With MFA

The AWS Account needs to be set-up with Access Key and Secret Key, if MFA is configured, it will be configured with a Virtual MFA Device. This ARN can be found in your IAM Account.

aws configure                             # May not be required
aws sts get-session-token --serial-number arn:aws:iam::<accountnumber>:mfa/<username> --token-code <6 Digit Code>
aws configure                             # Update Secret and Key
aws configure set aws_session_token <SESSION_TOKEN_HERE> # Add temporary Session Token
aws iam generate-credential-report        # Generates IAM Credential Report

Without MFA

This approach is not advised

aws configure                             # Update Secret and Key
aws iam generate-credential-report        # Generates IAM Credential Report

IAM Roles

Roles can be created as additional profiles in the credentials file

  1. Confirm the AWS Account Number, and the Name of the Role to use
  2. Edit the credentials file and create a new profile as such:
[<profile name>]
    role_arn = arn:aws:iam::<account number>:role/<Role Name>
    source_profile = default

Note: the above example references the default profile, and can be changed as required, it should reference the Org Profile though.

  1. create an IAM credential report
aws iam generate-credential-report --profile <newly created profile name>       # Generates IAM Credential Report

More information can be found here

Azure

Modern Authentication Web Portal

If your client supports Modern Auth and can instigate a browser session this is the ideal approach

az login

Modern Authentication Web URL

If your client does not support, or fails to launch a browser session, you may be asked to navigate to a URL and provide a Code to Authenticate

az login --use-device-code

GCP

Login without GUI (via Browser)

gcloud auth application-default login --no-launch-browser
gcloud projects list
gcloud config set project [PROJECT_ID]
⚠️ **GitHub.com Fallback** ⚠️