如何在 AWS 上创建临时安全凭证

Question

I'm trying to use Apache Libcloud (Web) and reading the Documentation of how to use it with Amazon EC2 I'm stuck on a step at the beginning.

On this step:

from libcloud.compute.types import Provider
from libcloud.compute.providers import get_driver

cls = get_driver(Provider.EC2)
driver = cls('temporary access key', 'temporary secret key',
             token='temporary session token', region="us-west-1")

You need to pass the temporary access data and tells you to read Amazon Documentation but also I've read the documentation I don't get very clear what I have to do to get my temporal credentials.

On the doc says that you can interact with the AWS STS API to connect to the endpoint but I don't understand how do you get the credentials. Moreover, on the example of Libcloud Web they use the personal credentials:

ACCESS_ID = 'your access id'
SECRET_KEY = 'your secret key'

So I'm a bit lost. How I can get my temporal credentials to use it on my code?

Thanks and regards.

Answer 1

If this code does not run on an EC2 instance I suggest you go with static credentials:

ACCESS_ID = 'your access id'
SECRET_KEY = 'your secret key'

cls = get_driver(Provider.EC2)
driver = cls(ACCESS_ID, SECRET_KEY, region="us-west-1")

to create access credentials:

1. Sign in to the Identity and Access Management (IAM) console at https://console.aws.amazon.com/iam/ .
2. In the navigation pane, choose Users.
3. Choose the name of the desired user, and then choose the Security Credentials tab.

If needed, expand the Access Keys section and do any of the following:

Choose Create Access Key and then choose Download Credentials to save the access key ID and secret access key to a CSV file on your computer. Store the file in a secure location. You will not have access to the secret access key again after this dialog box closes. After you have downloaded the CSV file, choose Close.

if you want to run your code from an EC2 machine you can get temporary credentials by assuming an IAM role using the AWS SDK for Python https://boto3.readthedocs.io/en/latest/guide/quickstart.html by calling assume_role() on the STS service https://boto3.readthedocs.io/en/latest/reference/services/sts.html

Answer 2

@Aker666 from what I have found on the web, you're still expected to use the regular AWS api to obtain this information.

The basic snippet that works for me is:

import boto3
from libcloud.compute.types import Provider
from libcloud.compute.providers import get_driver


boto3.setup_default_session(aws_access_key_id='somekey',aws_secret_access_key='somesecret',region_name="eu-west-1")
sts_client = boto3.client('sts')
assumed_role_object = sts_client.assume_role(
                    RoleArn="arn:aws:iam::701********:role/iTerm_RO_from_TGT",
                    RoleSessionName='update-cloud-hosts.aviadraviv@Aviads-MacBook-Pro.local'
)


cls = get_driver(Provider.EC2)
driver = cls(assumed_role_object['Credentials']['AccessKeyId'], assumed_role_object['Credentials']['SecretAccessKey'],
             token=assumed_role_object['Credentials']['SessionToken'], region="eu-west-1")


nodes = driver.list_nodes()
print(nodes)

Hope this helps anyone.