如果你已经获得了一些 IAM 凭证,你可能会对使用以下工具访问 web 控制台感兴趣。
注意,用户/角色必须具有权限 sts:GetFederationToken。
自定义脚本
以下脚本将使用默认配置文件和默认 AWS 位置(非 gov 和非 cn)为你提供一个签名 URL,你可以使用它登录到 web 控制台:
# Get federated creds (you must indicate a policy or they won't have any perms)## Even if you don't have Admin access you can indicate that policy to make sure you get all your privileges## Don't forget to use [--profile <prof_name>] in the first line if you need tooutput=$(awsstsget-federation-token--nameconsoler--policy-arnsarn=arn:aws:iam::aws:policy/AdministratorAccess)if [ $? -ne0 ]; thenecho"The command 'aws sts get-federation-token --name consoler' failed with exit status $status"exit $statusfi# Parse the outputsession_id=$(echo $output |jq-r'.Credentials.AccessKeyId')session_key=$(echo $output |jq-r'.Credentials.SecretAccessKey')session_token=$(echo $output |jq-r'.Credentials.SessionToken')# Construct the JSON credentials stringjson_creds=$(echo -n "{\"sessionId\":\"$session_id\",\"sessionKey\":\"$session_key\",\"sessionToken\":\"$session_token\"}")
# Define the AWS federation endpointfederation_endpoint="https://signin.aws.amazon.com/federation"# Make the HTTP request to get the sign-in tokenresp=$(curl-s"$federation_endpoint" \--get \--data-urlencode "Action=getSigninToken" \--data-urlencode "SessionDuration=43200" \--data-urlencode "Session=$json_creds")signin_token=$(echo-n $resp |jq-r'.SigninToken'|tr-d'\n'|jq-sRr@uri)# Give the URL to loginecho -n "https://signin.aws.amazon.com/federation?Action=login&Issuer=example.com&Destination=https%3A%2F%2Fconsole.aws.amazon.com%2F&SigninToken=$signin_token"