AWS assuming role + MFA with pulumi (and other applications)

Introduction

In AWS, managing your IAM in a centralized account is a good practice, so then you can assume a role to access to other accounts without need of duplicating users. You can find more info about this approach in this article.

In addition, for security reasons, it is highly recommended to enable MFA (Multi-factor Authentication), so you need a device to generate a temporary code to get access. In the image below it is showed how assume role with MFA works, but you also have an article about MFA in this link.


This approach is really useful and most of the configuration can be automated with pulumi (or other providers like terraform or CloudFormation). And once it is configured, you can switch your role and get access to other accounts with a few clicks. 

However, when it comes to external software such us pulumi, getting access assuming a role and using MFA might not be too straightforward. In this article we will see how this can be configured and how we can easily refresh our credentials with a PowerShell script. 

Getting access with assume role + MFA for pulumi

In this section, we will explain how you can setup manually your credentials, so pulumi can get access to your account by assuming a role + using MFA.

Getting a token by using MFA

First, you need to request temporary MFA credentials, using your AWS Access Key and Secret Key for your user in the account where you have your IAM user. In order to so, you can run this command, which will issue your temporary credentials valid for 8 hours (max 36 hours):

aws sts get-session-token --duration-seconds 28800 --serial-number arn-of-the-mfa-device --token-code code-from-token

Where:

  • arn-of-the-mfa-device: you can find it in AWS Ops account, if you click on your user (top bar), then "My security credentials".
  • from-token: numeric code that you can get this code with the app you are using for MFA.

Setup your AWS profile credentials

Then, you need to  add two profiles. One to setup your temporary credentials and another to assume the role for the account that you want to get access. 

In order to setup to setup these profiles, you have to go to C:\Users\YourUser\.aws\credentials. 

Then, you need to add these profiles:



[dev]
role_arn = arn:aws:iam::#account_number#:role/#YourRole#
source_profile = mfa
[mfa]
aws_access_key_id = #aws_access_key_id_from_get-session-token_command#
aws_secret_access_key = #aws_secret_access_key_from_get-session-token_command#
aws_session_token = #aws_session_token_from_get-session-token_command#

So basically, when you use [dev] profile, it will assume the role you configured using the credentials that you setup in [mfa].

Configure pulumi or other applications

In order to use your profile in pulumi, in the stack folder, you need to run this command:

pulumi config set aws:profile dev

For console commands or other local tools, setup your environment variable properly with PowerShell or CMD bash (*):

setx AWS_PROFILE dev

(*) To apply the change when you update an environment variable, you need to reset your terminal.

Automating credentials refresh with PowerShell

This process is quite straightforward, but it can be a little annoying if you have to perform those manual steps each time you want to refresh your credentials. 

In order to make this process really easy, I've created a PowerShell script, which will request your MFA code and it will refresh your profile with those credentials. 

$MfaDeviceArn = "#YOUR_MFA_DEVICE_ARN#"
$DurationInSeconds = 28800
$OpsProfileName = "ops"
$MfaProfileName = "mfadev"

$MfaCode = Read-Host -Prompt 'Please, input your MFA code'

$TempCredentials = aws sts get-session-token --duration-seconds $DurationInSeconds --serial-number $MfaDeviceArn --token-code $MfaCode --profile $OpsProfileName  | ConvertFrom-Json 

Write-Output "Updating your profile '$MfaProfileName' with your new temporary credentials..."

$AccessKeyId = ($TempCredentials).Credentials.AccessKeyId
$SecretAccessKey = ($TempCredentials).Credentials.SecretAccessKey
$SessionToken = ($TempCredentials).Credentials.SessionToken

aws configure set aws_access_key_id $AccessKeyId --profile $MfaProfileName
aws configure set aws_secret_access_key $SecretAccessKey --profile $MfaProfileName
aws configure set aws_session_token $SessionToken --profile $MfaProfileName

Write-Output "Profile '$MfaProfileName' updated successfully!"
Read-Host  -Prompt "Press any key to continue or CTRL+C to quit" 

So now, when we execute the script, I will request our MFA code and it will setup those credentials in our profile automatically.


You can find the source code in this Git gist: https://gist.github.com/albertocorrales/f05c1f84554d20e3d32222964dcfaef0 . 

I hope you found useful this article

Comments

Post a Comment

Popular posts from this blog

Building Micro-Frontends with Single-Spa

Image
Introduction Micro-services architecture is becoming trendy since it is a suitable option many projects, specially those that are complex and we want to be able spilt our business logic into different services that can be built and deliver independently. In spite of the fact that micro-services architectures are more complex, they increase the resilience of your system and increase the time-to-market delivery, which can be crucial for many companies. But it is not all about services and backend. With the introduction of single page applications (SPAs), we can build fully-functional user interfaces that can work independently in the browser. And here we should ask ourselves the same questions as for backend applications: Is my SPA becoming a huge monolith? Would I like to deliver functional modules independently? If you using micro-services, is there a relation between my services and your UI? Do we want to have functional teams that can deliver new features (frontend+backend) independe
Read more

Why you should migrate your old csproj to SDK format

Image
Introduction  With the introduction of Visual Studio 2017, the format used for csproj was updated including several advantages. This new format will be used when you create a new .Net Core project or .Net Standard library. In spite of the fact that VS2017 continues supporting old csproj format, you can migrate your old projects to SDK format. As a result, you will have the following benefits: Cleaner csproj files. With new format, a lot of things can be omitted, so your csproj files will be cleaner. Files are included using a wildcard , instead of including every single file.  Solution project references are simplier . NuGet reference packages as PackageReferences , so you won't need packages.config and you will be able to use wildcard in your references (for example, 1.0.*). NuGet package definition as a part of the project file. You won't need more nuspec files. Definition of AssemblyInfo attributes in csproj , you won't need more AssemblyInfo.cs files. In ad
Read more