Amazon web services aws sts假定角色返回accesskeyid masked“***&引用;
我在一个代码构建映像中调用Amazon web services aws sts假定角色返回accesskeyid masked“***&引用;,amazon-web-services,aws-codepipeline,aws-codebuild,assume-role,Amazon Web Services,Aws Codepipeline,Aws Codebuild,Assume Role,我在一个代码构建映像中调用sts假设角色,响应凭证具有accessKeyId=“***”如下所示 另外,当从本地计算机尝试相同的命令时,我获得了正确的accesskeyId。你知道我在这里遗漏了什么吗 请求: aws sts承担角色--角色arn:aws:iam::11111111:角色/codepipeline\u角色--角色会话名称codepipeline\u角色 样本响应: { “假定代理人”:{ “Arn”:“Arn:aws:sts::111111111:假定角色/codepipeli
sts假设角色
,响应凭证具有accessKeyId=“***”
如下所示
另外,当从本地计算机尝试相同的命令时,我获得了正确的accesskeyId。你知道我在这里遗漏了什么吗
请求:
aws sts承担角色--角色arn:aws:iam::11111111:角色/codepipeline\u角色--角色会话名称codepipeline\u角色
样本响应:
{
“假定代理人”:{
“Arn”:“Arn:aws:sts::111111111:假定角色/codepipeline\u角色/codepipeline角色”,
“AssumedRoleId”:“AROA6DS4I2EQXD2H5OXYE:代码管道角色”
},
“全权证书”:{
“AccessKeyId”:“***”,
“到期日”:“2020-01-04T16:23:56Z”,
“SecretAccessKey”:“SecretAccessKey”,
“SessionToken”:“SessionToken”
}
}
提前谢谢 您可以尝试使用这些值吗?它可以在回声时被掩盖
version: 0.2
phases:
install:
commands:
- apt-get update
- apt-get install -y jq
- RESPONSE=$(aws sts assume-role --role-arn arn:aws:iam::123456789012:role/CLIRole --role-session-name `date "+%Y%m%d_%H%M%S"`)
- export AWS_ACCESS_KEY_ID=$(echo $RESPONSE | jq -r '.Credentials.AccessKeyId')
- export AWS_SECRET_ACCESS_KEY=$(echo $RESPONSE | jq -r '.Credentials.SecretAccessKey')
- export AWS_SESSION_TOKEN=$(echo $RESPONSE | jq -r '.Credentials.SessionToken')
#- Your aws cli command here...
编辑1:
使用以下buildspec(从CodePipeline调用CodeBuild)进行检查,可以确认角色假设成功。当您回音时,***正处于掩蔽状态:
version: 0.2
phases:
install:
runtime-versions:
nodejs: 8
commands:
- ASSUME_ROLE_ARN="arn:aws:iam::123456789012:role/Shariq-Assumption-Test-Role"
- aws sts get-caller-identity
- TEMP_ROLE=`aws sts assume-role --role-arn $ASSUME_ROLE_ARN --role-session-name test`
- export TEMP_ROLE
- echo $TEMP_ROLE
- export AWS_ACCESS_KEY_ID=$(echo "${TEMP_ROLE}" | jq -r '.Credentials.AccessKeyId')
- export AWS_SECRET_ACCESS_KEY=$(echo "${TEMP_ROLE}" | jq -r '.Credentials.SecretAccessKey')
- export AWS_SESSION_TOKEN=$(echo "${TEMP_ROLE}" | jq -r '.Credentials.SessionToken')
- echo $AWS_ACCESS_KEY_ID
- echo $AWS_SECRET_ACCESS_KEY
- echo $AWS_SESSION_TOKEN
- aws sts get-caller-identity
“Shariq假设测试角色”具有以下信任策略:
{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Principal": {
"AWS": "arn:aws:iam::12345678910:root",
"Service": "codebuild.amazonaws.com"
},
"Action": "sts:AssumeRole"
}
]
}
此外,代码构建角色应该具有sts:AssumeRole权限
生成日志:
[Container] 2020/01/05 12:59:13 Running command ASSUME_ROLE_ARN="arn:aws:iam::123456789012:role/Shariq-Assumption-Test-Role"
[Container] 2020/01/05 12:59:13 Running command aws sts get-caller-identity
{
"UserId": "AROAXTEXAMPLEQ22FQDC:AWSCodeBuild-xxxxxxxx-104c-42b9-b71c-ff3e8ad44b16",
"Account": "123456789012",
"Arn": "arn:aws:sts::123456789012:assumed-role/codebuild-build-from-cp-service-role/AWSCodeBuild-xxxxxxxx-104c-42b9-b71c-ff3e8ad44b16"
}
[Container] 2020/01/05 12:59:18 Running command TEMP_ROLE=`aws sts assume-role --role-arn $ASSUME_ROLE_ARN --role-session-name test`
[Container] 2020/01/05 12:59:18 Running command export TEMP_ROLE
[Container] 2020/01/05 12:59:18 Running command echo $TEMP_ROLE
{ "Credentials": { "AccessKeyId": "***", "SecretAccessKey": "R9QuqToY4qkcEXAMPLESGmTGJi4QawzS", "SessionToken": "FwoGZXIvYXdzEA4aDIwhkn5nVvvFBeBxXSLGAZmE1/Kw0CA9a/PEUG6VXyHyTrVryYzyRDEPdFUlzhXjqBj9h5x/Cz5aX/61aR2qSEXAMPLEBqm7OsI3zD3KA3NIIAr/u+l9f8AGZz+Ii6AeUoLFrkvH7d7JINGvouRNdrulkbzbnAAtGQx+8K1DxR0w4TbPbld3hQJYanGf6I4v3EieJuRckqxloEO6gF9W9EsqsluOogJVJAziimu8fwBTJLaKyaqg2Rr6w4JqrIB9fUngEnif/ggbIrscuadGLhXe7bSRKCrerk5DzEGP1uiZwH3P/De9wIOOClq", "Expiration": "2020-01-05T13:59:18Z" }, "AssumedRoleUser": { "AssumedRoleId": "AROAXTLSHEXAMPLE2TZT:test", "Arn": "arn:aws:sts::123456789012:assumed-role/Shariq-Assumption-Test-Role/test" } }
[Container] 2020/01/05 12:59:18 Running command export AWS_ACCESS_KEY_ID=$(echo "${TEMP_ROLE}" | jq -r '.Credentials.AccessKeyId')
[Container] 2020/01/05 12:59:18 Running command export AWS_SECRET_ACCESS_KEY=$(echo "${TEMP_ROLE}" | jq -r '.Credentials.SecretAccessKey')
[Container] 2020/01/05 12:59:18 Running command export AWS_SESSION_TOKEN=$(echo "${TEMP_ROLE}" | jq -r '.Credentials.SessionToken')
[Container] 2020/01/05 12:59:18 Running command echo $AWS_ACCESS_KEY_ID
***
[Container] 2020/01/05 12:59:18 Running command echo $AWS_SECRET_ACCESS_KEY
R9QuqToY4qkct327ZEXAMPLEmTGJi4QawzS
[Container] 2020/01/05 12:59:18 Running command echo $AWS_SESSION_TOKEN
FwoGZXIvYXdzEA4aDIwhkn5nVvvFBeBxXSLGAZmE1/Kw0CA9a/PEUG6VXyHyTrVryYzyRDEPdFUlzhXjqBj9h5x/Cz5aX/61aR2qSGwqMEjJToh0Bqm7OsI3zD3K4ot7wAeUoLFrkvH7d7JINGvouRNdrulkbzbnAAtGQx+8K1DxR0w4TbPbld3hQJYanEXAMPLE0h3U5xLXykuEcvOnuV6gF9W9EsqsluOogJVJAziimu8fwBTJLaKyaqg2Rr6w4JqrIB9fUngEnif/ggbIrscuadGLhXe7bSRKCrerk5DzEGPzqyMFCH+DHYsbeIeqXkbFYW1uiZwH3P/De9wIOOClq
[Container] 2020/01/05 12:59:18 Running command aws sts get-caller-identity
{
"UserId": "AROAXTLEXAMPLELVE2TZT:test",
"Account": "123456789012",
"Arn": "arn:aws:sts::123456789012:assumed-role/Shariq-Assumption-Test-Role/test"
}
非常奇怪的是,某些进程会屏蔽访问密钥而不是密钥。如果有的话,这是向后的,但是一个普通的STS AssumeRole不会在其响应中屏蔽这两个角色(否则您显然无法使用返回的凭据)。您实际上是如何调用sts角色的?有没有任何代码可以进行这种掩蔽?@jarmod是的,确实很奇怪。这是我如何调用sts的,我已经用我使用sts发出的请求更新了这个问题。给一点背景;我正在尝试使用codebuild跨帐户部署一个无服务器应用程序。CodePipeline具有屏蔽awscli输出中机密的功能(请参阅)。虽然不能100%确定这是您的问题,但值得一读。“***”是CodeBuild尽最大努力屏蔽日志文件中敏感信息的结果。要使用creds,您需要访问密钥和机密,因此屏蔽其中一个或两个都有效。然而,只有访问密钥id具有长度为20个字符的特定前缀“AKIA”和“ASIA”。机密访问密钥是40个随机字符,试图屏蔽可能会屏蔽任何恰好为40个字符长的非机密访问密钥字符串。是的,我以前也尝试过这种方法,但没有效果。请参阅编辑1。感谢您的澄清和示例。你是对的,它只是在回音上被蒙住了。谢谢你用示例解释如何使用这个角色