AWS IAM角色的应用

 

前言AWS Identity and Access Management (IAM) 是一种 Web 服务，可以帮助您安全地控制对 AWS 资源的访问。您可以使用 IAM 控制对哪个用户进行身份验证 (登录) 和授权 (具有权限) 以使用资源。 
AWS上有IAM的概念，IAM角色可以更加精准的控制权限，方便扩展。 
一、EC2针对 EC2 上面的应用程序，不要分配 User Credentials，使用 IAM Role Attachment。 
可以访问 EC2 的 meatdata 查看赋予的 Role 权限 
curl http://169.254.169.254/latest/meta-data/iam/security-credentials/二、Software on local laptop针对在自己电脑上面开发测试的用户，用户需要 S3 的访问权限，不给用户分配权限，这样可以避免 AK/SK 丢失造成的损失，我们可以给 User 分配一个 Cross accunt role，让用户使用接口 assume-role 获取临时的 AK/SK，然后去访问AWS 资源。 
2.1、创建用户 alice不给用户分配任何权限。 

最后得到用户的 AK/SK 
Access key ID ：AKIA5NAGHF6N2WFTQZP6Secret access key：TqJ/9Hg450x204r1lai+C3w0+3kvVOeTckPZhvau2.2、创建一个跨账户 Role（同账户下） 
给角色增加权限。 


生成的 Role ARN：arn:aws:iam::921283538843:role/alice-sts把生成的 Role 的 trust relationships policy 修改为如下，试 alice 这个用户可以 assumerole 这个角色， 
{ "Version": "2012-10-17", "Statement": [  {   "Effect": "Allow",   "Principal": {    "AWS": "arn:aws:iam::921283538843:user/alice"   },   "Action": "sts:AssumeRole",   "Condition": {}  } ]}2.3、测试用户权限直接使用 AK/SK，查看用户是否有相应的权限。 
使用 aws configure 配置。 
wangzan:~/.aws $ aws configure --profile aliceAWS Access Key ID [****************H6YU]: AKIA5NAGHF6N2WFTQZP6AWS Secret Access Key [****************bVA/]: TqJ/9Hg450x204r1lai+C3w0+3kvVOeTckPZhvauDefault region name [us-east-1]: Default output format [json]: wangzan:~/.aws $ aws sts get-caller-identity --profile alice{  "Account": "921283538843",   "UserId": "AIDA5NAGHF6NZASTSA7Y6",   "Arn": "arn:aws:iam::921283538843:user/alice"}wangzan:~/.aws $ aws s3 ls --profile aliceAn error occurred (AccessDenied) when calling the ListBuckets operation: Access Denied直接使用是获取不到权限的，那我们使用 assume-role。 
wangzan:~ $ aws sts assume-role --role-arn arn:aws:iam::921283538843:role/alice-sts --role-session-name alice1233 --profile alice                                                         {  "AssumedRoleUser": {    "AssumedRoleId": "AROA5NAGHF6N7DOEADJSU:alice1233",     "Arn": "arn:aws:sts::921283538843:assumed-role/alice-sts/alice1233"  },   "Credentials": {    "SecretAccessKey": "bmP9j6fuZ03MgrQCzrix6YLRcHzLojrThII6I5k7",     "SessionToken": "IQoJb3JpZ2luX2VjEIH//wEaCXVzLWVhc3QtMSJHMEUCICUEnSV87qoGrBDliGHwPTc0EPSqbzjLMX/8F2QUmejdAiEAxfX3L+MipZOTGKYLxH2qeTlnkvNtY3laE1hlEmcgaEMq2QEI6f//ARAAGgw5MjEyODM1Mzg4NDMiDIz9v0YIqXkeT4/YjSqtAc4g0fFXYua7fvzVveDq9twCc0jtHoz+k8425aL2qcpOTyGxDyWEIpt5Qp3DlZkCEMOgz8VPw/VhXQOuvTBF2nfEPDVsjk0J1rL/xP/8VDe1/Op13qu7QGtvOog00/0qAr2GTsSOkrQnHcOfcXpirz+Ll+rlVEp5WGjke4NTQjYlcKuGud2totcdWuvd39o6RugOOuTEf/UanuPmgvwlNVG6qfSZK6MAl0yJ2NNgMPSCrPAFOuMBw/R25StiLs+ZoGj7nhmL17I7ggW33DdH12FwXwqrOb3nBJxXFyaS3N7U/VJRCWPYQ95RuatJRWiBOvWoBB1KI5tdb0xKStW0VCRUpB2iipJcVFFikJyphf/HzK03AHQ4N4DiPFz30RlFyZVXyV4E/O9CqzKtp09MD+Chuq298Yjq4NDk1Wi5s75JpfuVvtU7FUGb3Li2OfE68GHBybfKR3Gvg1oDJy1QZGqLrUCJp/oZ8Wjg9xOg/2Vg3PUjlgCnlE+rrkZVuF+aAJfB1mVrMBF8XFGtfZQF9QMgzugrJAbZ4Uk=",     "Expiration": "2019-12-31T09:06:12Z",     "AccessKeyId": "ASIA5NAGHF6NZZ5HBX7R"  }}然后去编辑 ~/.aws/credentials，把生成的Credentials放到里面，如下： 
[alice-sts]aws_access_key_id = ASIA5NAGHF6NZZ5HBX7Raws_secret_access_key = bmP9j6fuZ03MgrQCzrix6YLRcHzLojrThII6I5k7aws_session_token = IQoJb3JpZ2luX2VjEIH//wEaCXVzLWVhc3QtMSJHMEUCICUEnSV87qoGrBDliGHwPTc0EPSqbzjLMX/8F2QUmejdAiEAxfX3L+MipZOTGKYLxH2qeTlnkvNtY3laE1hlEmcgaEMq2QEI6f//ARAAGgw5MjEyODM1Mzg4NDMiDIz9v0YIqXkeT4/YjSqtAc4g0fFXYua7fvzVveDq9twCc0jtHoz+k8425aL2qcpOTyGxDyWEIpt5Qp3DlZkCEMOgz8VPw/VhXQOuvTBF2nfEPDVsjk0J1rL/xP/8VDe1/Op13qu7QGtvOog00/0qAr2GTsSOkrQnHcOfcXpirz+Ll+rlVEp5WGjke4NTQjYlcKuGud2totcdWuvd39o6RugOOuTEf/UanuPmgvwlNVG6qfSZK6MAl0yJ2NNgMPSCrPAFOuMBw/R25StiLs+ZoGj7nhmL17I7ggW33DdH12FwXwqrOb3nBJxXFyaS3N7U/VJRCWPYQ95RuatJRWiBOvWoBB1KI5tdb0xKStW0VCRUpB2iipJcVFFikJyphf/HzK03AHQ4N4DiPFz30RlFyZVXyV4E/O9CqzKtp09MD+Chuq298Yjq4NDk1Wi5s75JpfuVvtU7FUGb3Li2OfE68GHBybfKR3Gvg1oDJy1QZGqLrUCJp/oZ8Wjg9xOg/2Vg3PUjlgCnlE+rrkZVuF+aAJfB1mVrMBF8XFGtfZQF9QMgzugrJAbZ4Uk=然后再去请求 S3。 
wangzan:~/.aws $ aws sts get-caller-identity --profile alice-sts{  "Account": "921283538843",   "UserId": "AROA5NAGHF6N7DOEADJSU:alice1233",   "Arn": "arn:aws:sts::921283538843:assumed-role/alice-sts/alice1233"} 
2.4、自动更换临时权限修改 ~/.aws/credentials，增加如下字段， 
[alice-auto]role_arn = arn:aws:iam::921283538843:role/alice-stssource_profile = alice可以看下目前的 Role。 
wangzan:~ $ aws sts get-caller-identity --profile alice-auto{  "Account": "921283538843",   "UserId": "AROA5NAGHF6N7DOEADJSU:botocore-session-1577780458",   "Arn": "arn:aws:sts::921283538843:assumed-role/alice-sts/botocore-session-1577780458"} 

 iplc专线网络，是可以在香港与其他地区（包括中国大陆、新加坡、菲律宾、日本、韩国）之间构建物理专线，将香港数据中心与其他地区的数据中心、云、企业分支、办公室或主机托管环境对接起来，实现高速私网通信。这种私网通信可以绕过公网，两端通信低至 5ms，最终形成一种比基于 Internet 连接更为私密、稳定、高速的网络体验。