AWS assuming role + MFA with pulumi (and other applications)

Introduction

In AWS, managing your IAM in a centralized account is a good practice, so then you can assume a role to access to other accounts without need of duplicating users. You can find more info about this approach in this article.

In addition, for security reasons, it is highly recommended to enable MFA (Multi-factor Authentication), so you need a device to generate a temporary code to get access. In the image below it is showed how assume role with MFA works, but you also have an article about MFA in this link.


This approach is really useful and most of the configuration can be automated with pulumi (or other providers like terraform or CloudFormation). And once it is configured, you can switch your role and get access to other accounts with a few clicks. 

However, when it comes to external software such us pulumi, getting access assuming a role and using MFA might not be too straightforward. In this article we will see how this can be configured and how we can easily refresh our credentials with a PowerShell script. 

Getting access with assume role + MFA for pulumi

In this section, we will explain how you can setup manually your credentials, so pulumi can get access to your account by assuming a role + using MFA.

Getting a token by using MFA

First, you need to request temporary MFA credentials, using your AWS Access Key and Secret Key for your user in the account where you have your IAM user. In order to so, you can run this command, which will issue your temporary credentials valid for 8 hours (max 36 hours):

aws sts get-session-token --duration-seconds 28800 --serial-number arn-of-the-mfa-device --token-code code-from-token

Where:

  • arn-of-the-mfa-device: you can find it in AWS Ops account, if you click on your user (top bar), then "My security credentials".
  • from-token: numeric code that you can get this code with the app you are using for MFA.

Setup your AWS profile credentials

Then, you need to  add two profiles. One to setup your temporary credentials and another to assume the role for the account that you want to get access. 

In order to setup to setup these profiles, you have to go to C:\Users\YourUser\.aws\credentials. 

Then, you need to add these profiles:



[dev]
role_arn = arn:aws:iam::#account_number#:role/#YourRole#
source_profile = mfa
[mfa]
aws_access_key_id = #aws_access_key_id_from_get-session-token_command#
aws_secret_access_key = #aws_secret_access_key_from_get-session-token_command#
aws_session_token = #aws_session_token_from_get-session-token_command#

So basically, when you use [dev] profile, it will assume the role you configured using the credentials that you setup in [mfa].

Configure pulumi or other applications

In order to use your profile in pulumi, in the stack folder, you need to run this command:

pulumi config set aws:profile dev

For console commands or other local tools, setup your environment variable properly with PowerShell or CMD bash (*):

setx AWS_PROFILE dev

(*) To apply the change when you update an environment variable, you need to reset your terminal.

Automating credentials refresh with PowerShell

This process is quite straightforward, but it can be a little annoying if you have to perform those manual steps each time you want to refresh your credentials. 

In order to make this process really easy, I've created a PowerShell script, which will request your MFA code and it will refresh your profile with those credentials. 

$MfaDeviceArn = "#YOUR_MFA_DEVICE_ARN#"
$DurationInSeconds = 28800
$OpsProfileName = "ops"
$MfaProfileName = "mfadev"

$MfaCode = Read-Host -Prompt 'Please, input your MFA code'

$TempCredentials = aws sts get-session-token --duration-seconds $DurationInSeconds --serial-number $MfaDeviceArn --token-code $MfaCode --profile $OpsProfileName  | ConvertFrom-Json 

Write-Output "Updating your profile '$MfaProfileName' with your new temporary credentials..."

$AccessKeyId = ($TempCredentials).Credentials.AccessKeyId
$SecretAccessKey = ($TempCredentials).Credentials.SecretAccessKey
$SessionToken = ($TempCredentials).Credentials.SessionToken

aws configure set aws_access_key_id $AccessKeyId --profile $MfaProfileName
aws configure set aws_secret_access_key $SecretAccessKey --profile $MfaProfileName
aws configure set aws_session_token $SessionToken --profile $MfaProfileName

Write-Output "Profile '$MfaProfileName' updated successfully!"
Read-Host  -Prompt "Press any key to continue or CTRL+C to quit" 

So now, when we execute the script, I will request our MFA code and it will setup those credentials in our profile automatically.


You can find the source code in this Git gist: https://gist.github.com/albertocorrales/f05c1f84554d20e3d32222964dcfaef0 . 

I hope you found useful this article

Comments

Post a Comment

Popular posts from this blog

Building Micro-Frontends with Single-Spa

Image
Introduction Micro-services architecture is becoming trendy since it is a suitable option many projects, specially those that are complex and we want to be able spilt our business logic into different services that can be built and deliver independently. In spite of the fact that micro-services architectures are more complex, they increase the resilience of your system and increase the time-to-market delivery, which can be crucial for many companies. But it is not all about services and backend. With the introduction of single page applications (SPAs), we can build fully-functional user interfaces that can work independently in the browser. And here we should ask ourselves the same questions as for backend applications: Is my SPA becoming a huge monolith? Would I like to deliver functional modules independently? If you using micro-services, is there a relation between my services and your UI? Do we want to have functional teams that can deliver new features (frontend+backend) independe...
Read more

Managing snapshots for Amazon ElasticSearch with Dotnet Core Lambdas

Image
Introduction It is awesome to have some useful services like ElasticSearch managed by AWS , so you don't have to care about patching, monitoring, etc.  When it comes to backup management for indexes, Amazon ElasticSearch includes automated snapshots. Automated snapshots are only for cluster recovery. You can use them to restore your domain in the event of red cluster status or other data loss. Amazon ES stores automated snapshots in a preconfigured Amazon S3 bucket at no additional charge. In particular, if you are using a higher version than 5.3, Amazon ElasticSearch takes hourly automated snapshots and retains up to 336 of them for 14 days. However, this policy might not be enough if you need to keep your snapshots for a longer 15 days, or you need to take a snapshot to create a new cluster in another region, subnet, etc. If you have different requirements to manage your snapshots, you will have to work with manual snapshots. For this part, AWS does not offer a good managed exper...
Read more