mkdir -p out
cd out
cat <<EOF > db.cfg
[req]
default_bits = 4096
default_keyfile = db.key
distinguished_name = req_distinguished_name
x509_extensions = v3_ca
prompt = no
[req_distinguished_name]
C = JP
ST = Tokyo
L = Foo
O = Foo
OU = Foo
CN= hogeyama
emailAddress = gan13027830@gmail.com
[v3_ca]
subjectKeyIdentifier=hash
basicConstraints = CA:true
authorityKeyIdentifier=keyid:always,issuer:always
keyUsage = cRLSign,keyCertSign,digitalSignature
[v3_req]
basicConstraints = CA:FALSE
keyUsage = nonRepudiation, digitalSignature, keyEncipherment
EOF
openssl genrsa -out cadb.key 4096
openssl req -x509 -new -nodes -key cadb.key -days 3650 -config db.cfg -out cadb.pem -extensions v3_ca
openssl genrsa -out db.key 4096
openssl req -new -key db.key -out db.csr -config db.cfg -extensions v3_req
openssl x509 -req -in db.csr -CA cadb.pem -CAkey cadb.key -CAcreateserial -out db.crt -days 365 -sha256 -extfile <(cat <<EOF
basicConstraints = CA:FALSE
keyUsage = nonRepudiation, digitalSignature, keyEncipherment
EOF
)Certificate request self-signature ok
subject=C = JP, ST = Tokyo, L = Foo, O = Foo, OU = Foo, CN = hogeyama, emailAddress = gan13027830@gmail.com
cat <<EOF >rolesanywhere-trust-policy.json
{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Principal": {
"Service": "rolesanywhere.amazonaws.com"
},
"Action": ["sts:AssumeRole", "sts:SetSourceIdentity", "sts:TagSession"],
"Condition": {
"StringEquals": {
"aws:PrincipalTag/x509Subject/CN": "hogeyama"
}
}
}
]
}
EOF
aws iam create-role \
--role-name ExampleS3WriteRole \
--assume-role-policy-document file://rolesanywhere-trust-policy.json
cat <<EOF >onpremsrv-permissions-policy.json
{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Action": "s3:PutObject",
"Resource": "arn:aws:s3:::hogeyama-test-bucket/*"
}
]
}
EOF
aws iam put-role-policy \
--role-name ExampleS3WriteRole \
--policy-name onpremsrv-inline-policy \
--policy-document file://onpremsrv-permissions-policy.jsonif [[ ! -e out/create-trust-anchor.yaml ]]; then
cat <<EOF > out/create-trust-anchor.yaml
enabled: true
name: 'my-test-anchor'
source:
sourceData:
x509CertificateData: |
$(cat out/cadb.pem | sed -e 's/^/ /')
sourceType: CERTIFICATE_BUNDLE
EOF
fi
aws rolesanywhere create-trust-anchor --cli-input-yaml file://out/create-trust-anchor.yamlif [[ ! -e out/create-profile.yaml ]]; then
cat <<EOF > out/create-profile.yaml
enabled: true
name: 'my-test-profile'
roleArns:
- '$(aws iam get-role --role-name ExampleS3WriteRole --output json | jq -r .Role.Arn)'
EOF
fi
aws rolesanywhere create-profile --cli-input-yaml file://out/create-profile.yamlif [[ ! -e aws_signing_helper ]]; then
wget https://rolesanywhere.amazonaws.com/releases/1.0.4/X86_64/Linux/aws_signing_helper
chmod +x ./aws_signing_helper
fi
TRUST_ANCHOR=$(aws rolesanywhere list-trust-anchors --output json \
| jq -r '.trustAnchors[]|select(.enabled and .name == "my-test-anchor")|.trustAnchorArn' \
)
PROFILE=$(aws rolesanywhere list-profiles --output json \
| jq -r '.profiles[]|select(.enabled and .name == "my-test-profile")|.profileArn' \
)
ROLE=$(aws iam get-role --role-name ExampleS3WriteRole --output json | jq -r .Role.Arn)
cat <<EOF > out/aws_config
[default]
credential_process = ./aws_signing_helper credential-process \
--certificate ./out/db.crt \
--private-key ./out/db.key \
--trust-anchor-arn "$TRUST_ANCHOR" \
--profile-arn "$PROFILE" \
--role-arn "$ROLE"
EOF
AWS_SHARED_CREDENTIALS_FILE=out/aws_config aws sts get-caller-identityAccount: '***'
Arn: arn:aws:sts::***:assumed-role/ExampleS3WriteRole/***
UserId: AROAZLZGN3Z6THCZXZXHB:***
おお〜
aws rolesanywhere list-trust-anchors --output json |
jq '.trustAnchors[]|.trustAnchorId' -r |
xargs -I@ aws rolesanywhere delete-trust-anchor --trust-anchor-id @
aws rolesanywhere list-profiles --output json |
jq '.profiles[]|.profileId' -r |
xargs -I@ aws rolesanywhere delete-profile --profile-id @