Home › Notes › AWS

AWS

AWS

aws sts get-caller-identity

aws configure list                    # Shows which source is being used
aws configure list --profile ni-dev   # Check specific profile

# removed from overton dns_chall
arn:aws:route53:::hostedzone/Z0443945xxxARXVAS

aws sts decode-authorization-message --encoded-message xxx \
  |jq '.DecodedMessage' |jq fromjson

aws sts assume-role \
  --role-arn arn:aws:iam::26xxx809:role/dev-ecr-ro \
  --role-session-name ECRListImagesSession
  
export AWS_ACCESS_KEY_ID=AKIAUxxxZCMJW37D
export AWS_SECRET_ACCESS_KEY=h/InxxxT8CMO16YaCEp
export AWS_DEFAULT_REGION=us-west-2
export AWS_REGION=us-west-2
export AWS_PROFILE=myron_admin
export AWS_SHARED_CREDENTIALS_FILE=~/.aws/credentials.overton

aws --profile xxx

# set role duration
aws iam update-role --role-name OrganizationAccountAccessRole --max-session-duration 43200
aws iam get-role --role-name ROLE_NAME --query 'Role.MaxSessionDuration'

  • Set account name / alias
    • IAM → Dashboard → AWS Account → Account Alias → Create
  • Access
    • ENV
      • ENV and credential file
        export AWS_SHARED_CREDENTIALS_FILE=~/.aws/credentials.overton
export AWS_CONFIG_FILE=
export AWS_SHARED_CREDENTIALS_FILE=
      export AWS_ACCESS_KEY_ID=AKIAUxxxZCMJW37D
export AWS_SECRET_ACCESS_KEY=h/InxxxT8CMO16YaCEp
export AWS_DEFAULT_REGION=us-west-2

aws s3 cp testfile s3://x-dev-customer/

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "VisualEditor0",
            "Effect": "Allow",
            "Action": [
                "s3:List*",
                "s3:GetAccessPoint",
                "s3:GetAccountPublicAccessBlock",
                "s3:CreateJob"
            ],
            "Resource": "*"
        },
        {
            "Sid": "VisualEditor1",
            "Effect": "Allow",
            "Action": "s3:*",
            "Resource": "arn:aws:s3:::x-customer/*"
        }
    ]
}
    • Root to sub account access
      • Create a policy 
        {
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": "sts:AssumeRole",
            "Resource": [
                "arn:aws:iam::6501xxx24:role/OrganizationAccountAccessRole"
            ]
        }
    ]
}
      • Use profile to tie role and root account together
      # ~/.aws/credentials
[axx]
aws_access_key_id = AKIAWTAxxAPWBX
aws_secret_access_key = 3b35...

# ~/.aws/config
[profile x-dev]
role_arn = arn:aws:iam::6501xxx2024:role/OrganizationAccountAccessRole
source_profile = sxx
region = us-east-1

# use --profile or set export AWS_PROFILE=myron_admin
# --profile position is command does matter
export AWS_PROFILE=mydev
aws sts get-caller-identity --profile mydev
  • AWS Localstack for testing local
    # test with --endpoint
aws --endpoint-url=http://localhost:4566 s3 ls

# docker compose snipet
  localstack:
    image: localstack/localstack:latest
    container_name: localstack
    ports:
      - '4566:4566'
    environment:
      - SERVICES=s3,sqs,sns,lambda,dynamodb,iam,sts,secretsmanager,ssm,cloudwatch,logs
      - DEBUG=0
      - PERSISTENCE=1
    volumes:
      - localstack_data:/var/lib/localstack
      - /var/run/docker.sock:/var/run/docker.sock
    restart: unless-stopped
  • Disk Space Metric
    aws --region us-west-1 \
cloudwatch put-metric-data \
--namespace x-prod \
--metric-name DiskSpace \
--unit Bytes \
--value $(df --output=pcent .|tail -1|cut -d% -f1)