|
| 1 | +# AWS SSO Programmatic Credentials, Programmatically |
| 2 | +When credentials are available via the AWS SSO Identity Center ("IDC"), we can [reasonably] easily get AWS credentials for use with the AWS tools that we know and love (SDKs, CLIs, PowerShell modules, etc.). |
| 3 | + |
| 4 | +Herein is a PowerShell module that simplifies getting accounts, roles, and credentials for some identity (the user). |
| 5 | + |
| 6 | +## What |
| 7 | +Simplify the creation of AWS credentials to SSO accounts/roles that an identity is entitled via AWS SSO Identity Center. |
| 8 | + |
| 9 | +## Quick Start |
| 10 | +To import this module |
| 11 | +1. Save or install the module from the PowerShell Gallery: |
| 12 | + ```powershell |
| 13 | + ## save it locally for initial inspection -- safety first! |
| 14 | + Find-Module vN.AWSSSO | Save-Module -Path C:\Temp |
| 15 | + ## ..then inspect code to confirm trustworthiness |
| 16 | +
|
| 17 | + ## orrr, install straight away, as vNugglets is a reputable publisher |
| 18 | + Find-Module vN.AWSSSO | Install-Module |
| 19 | + ``` |
| 20 | +1. Profit (see examples in [How](#how) section below) |
| 21 | +
|
| 22 | +### And, handy default value for Parameter |
| 23 | +To simplify even further the getting of temporary credentials from AWS for accounts/roles, we can make a default value for the `-StartUrl` parameter of `New-VNAWSSSOOIDCTokenViaDeviceCode`: |
| 24 | +```powershell |
| 25 | +$PSDefaultParameterValues['New-VNAWSSSOOIDCTokenViaDeviceCode:StartUrl'] = "https://mycoolstart.awsapps.com/start/" |
| 26 | +``` |
| 27 | +This then passes the given URL as the value for `-StartUrl` to this cmdlet each time we invoke the cmdlet. And, of course, we could put that default parameter value definition in somewhere like our PowerShell profile so that this default is always in place. |
| 28 | + |
| 29 | +## Why |
| 30 | +It is currently a bit more involved than "auth, then get creds for account/role". So, to make most simple the flow of getting such credentials in a natural way (minimal/zero configuration, and with rich objects and normal filtering we all know and love), let's abstract away the intricacies and make things "just work". 👍 |
| 31 | + |
| 32 | +## Gist |
| 33 | +Super simple pseudo code depiction: |
| 34 | +``` |
| 35 | +new oidc token | get accounts | get roles | get rolecred | do something with rolecred |
| 36 | +``` |
| 37 | + |
| 38 | +A bit more explicit-, but still pseudo, flow: |
| 39 | +```PowerShell |
| 40 | +## some pseudo code to describe the flow |
| 41 | +## get the SSO OIDC access token that will allow us to do subsequent things (get account info, get account role info, get role cred) |
| 42 | +new ssooidc token |
| 43 | +## get the accounts to which the OIDC token provides access |
| 44 | +get sso account list | Foreach-Object |
| 45 | + ## get the SSO-related roles to which we are entitled in the given AWS account |
| 46 | + get sso account role list | |
| 47 | + ## filter on <whatveer we like> to get just the account/role info for which to get temp creds |
| 48 | + Where-Object rolename matches something | Foreach-Object |
| 49 | + ## get the temp creds for the given account and role combos |
| 50 | + Get-SSORoleCredential |
| 51 | +## do something with those creds; for example, save them in the AWS creds location like .NET SDK or CLI "shared-creds" ini file) |
| 52 | +| save the AWS credential |
| 53 | +
|
| 54 | +## then, profit! |
| 55 | +``` |
| 56 | +## How |
| 57 | +A mostly realistic example of getting some credentials. |
| 58 | + |
| 59 | +1. Authenticate in your web browser as the account you want to use for AWS SSO interaction. For example, if Microsoft is the federated identity provider, go to the account management page there (https://myaccount.microsoft.com) and ensure that the desired account is "signed in" in the given web browser |
| 60 | +1. Using cmdlets from this module, get and filter some role/account info, generate new temp credentials, and save them: |
| 61 | + ```PowerShell |
| 62 | + ## make a new SSO OIDC token |
| 63 | + New-VNAWSSSOOIDCTokenViaDeviceCode -StartUrl https://mycoolstart.awsapps.com/start/ -Verbose |
| 64 | + ## get account/role info, filter, get cred for role, get AWS temp cred |
| 65 | + Get-VNAWSSSOAccountAndRoleInfo | |
| 66 | + Where-Object accountname -like my-cool-account-* | |
| 67 | + Where-Object RoleName -match _myadminrole_ | |
| 68 | + New-VNAWSSSORoleTempCredential -Verbose | |
| 69 | + ## save to the AWS creds file the temp creds for each account/role |
| 70 | + Set-AWSCredential -ProfileLocation (Resolve-Path ~\.aws\credentials) |
| 71 | + ``` |
| 72 | +
|
| 73 | +And, to see that example as a likely candidate to paste straight into a PowerShell session (one-line format): |
| 74 | +```PowerShell |
| 75 | +## make a new SSO OIDC token, get account/role info, filter, get cred for role, get AWS temp cred, save to the AWS creds file the temp creds for each account/role |
| 76 | +New-VNAWSSSOOIDCTokenViaDeviceCode -StartUrl https://mycoolstart.awsapps.com/start/; Get-VNAWSSSOAccountAndRoleInfo | Where-Object accountname -like my-cool-account-* | Where-Object RoleName -match _myadminrole_ | New-VNAWSSSORoleTempCredential -Verbose | Set-AWSCredential -ProfileLocation (Resolve-Path ~\.aws\credentials) |
| 77 | +``` |
| 78 | + |
| 79 | +## More Coolness 😎 |
| 80 | +One of the wonderful things that this approach enables is the programmatic retrieval of accounts and roles to which an identity/user is entitled. |
| 81 | + |
| 82 | +It is in the "get temp creds" example above, but to focus on the, "get all the roles/accounts I _could_ use" use case: |
| 83 | +```PowerShell |
| 84 | +## get _all_ account/role info for this user identity |
| 85 | +Get-VNAWSSSOAccountAndRoleInfo |
| 86 | +## *poof*! |
| 87 | +
|
| 88 | +## get account/role info, filter like all the other PowerShell filtering we already know and love ❣! |
| 89 | +Get-VNAWSSSOAccountAndRoleInfo | |
| 90 | + Where-Object accountname -like my-cool-account-* | |
| 91 | + Where-Object RoleName -match _myadminrole_ |
| 92 | +``` |
| 93 | + |
| 94 | +## Other |
| 95 | +The native AWS cmdlets can make all of this happen. This module is to simplify such things, so we can: |
| 96 | +- easily get the accounts and roles to which our identity is entitled |
| 97 | + - this enables the natural PowerShell behavior we know and love of, "get some stuff, maybe filter some stuff, then do something with the stuff" |
| 98 | + - so, for example, we can now programmatically get all of the accounts/roles to which we are entitled _as objects_, and then do the rest of the "cool" (valuable) stuff for the use case -- audit access, filter which roles to generate creds for, etc |
| 99 | +- easily generate role credentials |
| 100 | + - this also enables some natural PowerShell behavior: get some creds and do something with them; namely, save in the \<wherever the use case dictates> location |
| 101 | + - ...say, by piping the object to something that will store the credential, like `Set-AWSCredential`, and with the flexibility to specify the traditional filesystem shared-credentials file, or in a secure place (.NET SDK store), or wherever |
| 102 | + |
| 103 | +This module provides similar outcomes to the module https://github.com/e0c615c8e4d846ef817cd5063a88716c/AWSSSOHelper, but also focuses on enabling those aforementioned "natural" PowerShell capabilities / experiences / use-cases. |
0 commit comments