Skip to content

Instantly share code, notes, and snippets.

@Hogeyama
Created May 10, 2023 14:51
Show Gist options
  • Select an option

  • Save Hogeyama/e110dd5b589729a4d266f78d9a7efba6 to your computer and use it in GitHub Desktop.

Select an option

Save Hogeyama/e110dd5b589729a4d266f78d9a7efba6 to your computer and use it in GitHub Desktop.

証明書作成

mkdir -p out
cd out
cat <<EOF > db.cfg
[req]
default_bits = 4096
default_keyfile = db.key
distinguished_name = req_distinguished_name
x509_extensions = v3_ca
prompt = no
[req_distinguished_name]
C = JP
ST = Tokyo
L = Foo
O = Foo
OU = Foo
CN= hogeyama
emailAddress = gan13027830@gmail.com
[v3_ca]
subjectKeyIdentifier=hash
basicConstraints = CA:true
authorityKeyIdentifier=keyid:always,issuer:always
keyUsage = cRLSign,keyCertSign,digitalSignature
[v3_req]
basicConstraints = CA:FALSE
keyUsage = nonRepudiation, digitalSignature, keyEncipherment
EOF
openssl genrsa -out cadb.key 4096
openssl req -x509 -new -nodes -key cadb.key -days 3650 -config db.cfg -out cadb.pem -extensions v3_ca
openssl genrsa -out db.key 4096
openssl req -new -key db.key -out db.csr -config db.cfg -extensions v3_req
openssl x509 -req -in db.csr -CA cadb.pem -CAkey cadb.key -CAcreateserial -out db.crt -days 365 -sha256 -extfile <(cat <<EOF
basicConstraints = CA:FALSE
keyUsage = nonRepudiation, digitalSignature, keyEncipherment
EOF
)
Certificate request self-signature ok
subject=C = JP, ST = Tokyo, L = Foo, O = Foo, OU = Foo, CN = hogeyama, emailAddress = gan13027830@gmail.com

適当なロールを準備

cat <<EOF >rolesanywhere-trust-policy.json
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": {
        "Service": "rolesanywhere.amazonaws.com"
      },
      "Action": ["sts:AssumeRole", "sts:SetSourceIdentity", "sts:TagSession"],
      "Condition": {
        "StringEquals": {
          "aws:PrincipalTag/x509Subject/CN": "hogeyama"
        }
      }
    }
  ]
}
EOF
aws iam create-role \
  --role-name ExampleS3WriteRole \
  --assume-role-policy-document file://rolesanywhere-trust-policy.json

cat <<EOF >onpremsrv-permissions-policy.json
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": "s3:PutObject",
      "Resource": "arn:aws:s3:::hogeyama-test-bucket/*"
    }
  ]
}
EOF
aws iam put-role-policy \
  --role-name ExampleS3WriteRole \
  --policy-name onpremsrv-inline-policy \
  --policy-document file://onpremsrv-permissions-policy.json

trust-anchor の作成

if [[ ! -e out/create-trust-anchor.yaml ]]; then
  cat <<EOF > out/create-trust-anchor.yaml
enabled: true
name: 'my-test-anchor'
source:
  sourceData:
    x509CertificateData: |
$(cat out/cadb.pem | sed -e 's/^/      /')
  sourceType: CERTIFICATE_BUNDLE
EOF
fi
aws rolesanywhere create-trust-anchor --cli-input-yaml file://out/create-trust-anchor.yaml

profile の作成

if [[ ! -e out/create-profile.yaml ]]; then
  cat <<EOF > out/create-profile.yaml
enabled: true
name: 'my-test-profile'
roleArns:
- '$(aws iam get-role --role-name ExampleS3WriteRole --output json | jq -r .Role.Arn)'
EOF
fi
aws rolesanywhere create-profile --cli-input-yaml file://out/create-profile.yaml

使ってみる

if [[ ! -e aws_signing_helper ]]; then
  wget https://rolesanywhere.amazonaws.com/releases/1.0.4/X86_64/Linux/aws_signing_helper
  chmod +x ./aws_signing_helper 
fi
TRUST_ANCHOR=$(aws rolesanywhere list-trust-anchors --output json \
  | jq -r '.trustAnchors[]|select(.enabled and .name == "my-test-anchor")|.trustAnchorArn' \
)
PROFILE=$(aws rolesanywhere list-profiles --output json \
  | jq -r '.profiles[]|select(.enabled and .name == "my-test-profile")|.profileArn' \
)
ROLE=$(aws iam get-role --role-name ExampleS3WriteRole --output json | jq -r .Role.Arn)
cat <<EOF > out/aws_config
[default]
credential_process = ./aws_signing_helper credential-process \
--certificate ./out/db.crt \
--private-key ./out/db.key \
--trust-anchor-arn "$TRUST_ANCHOR" \
--profile-arn "$PROFILE" \
--role-arn "$ROLE"
EOF
AWS_SHARED_CREDENTIALS_FILE=out/aws_config aws sts get-caller-identity
Account: '***'
Arn: arn:aws:sts::***:assumed-role/ExampleS3WriteRole/***
UserId: AROAZLZGN3Z6THCZXZXHB:***

おお〜

clean up

aws rolesanywhere list-trust-anchors --output json |
  jq '.trustAnchors[]|.trustAnchorId' -r |
  xargs -I@ aws rolesanywhere delete-trust-anchor --trust-anchor-id @

aws rolesanywhere list-profiles --output json |
  jq '.profiles[]|.profileId' -r |
  xargs -I@ aws rolesanywhere delete-profile --profile-id @

参考

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment