我在.aws/credentials
中定义了AWS凭据,如下所示:
[profile source]
aws_access_key_id=...
aws_secret_access_key=...
[profile target]
role_arn = arn:aws:iam::123412341234:role/rolename
mfa_serial = arn:aws:iam::123412341234:mfa/mylogin
source_profile = source
...
我想在我的$PROFILE
到assume roles中定义函数,因为MFA和凭据生命周期为1小时,所以在上述帐户中使用AWS Tools for PowerShell。
函数如下所示
function Use-SomeAWS {
Clear-AWSCredential
$Response=(Use-STSRole arn:aws:iam::123412341234:role/rolename -ProfileName target -RoleSessionName "my email").Credentials
$Creds=(New-AWSCredentials -AccessKey $Response.AccessKeyId -SecretKey $Response.SecretAccessKey -SessionToken $Response.SessionToken)
Set-AWSCredential -Credential $Creds
}
复制和粘贴函数中的行可以正常工作,但是获取配置文件(. $PROFILE
)和运行函数(Use-SomeAWS
)需要MFA代码,并且似乎完成了它的工作,但是,没有为会话正确设置凭据。
我哪里做错了?
编辑:经过进一步的测试,如果我将-StoreAs someprofilename
添加到Set-AWSCredential * 中,然后执行Set-AWSCredential -ProfileName someprofilename
,确实 * 有效,但这种**违背了目的。
1条答案
按热度按时间gmxoilav1#
您是否尝试了Set-AWSCredential?的-Scope,如下所示:
https://docs.aws.amazon.com/powershell/latest/reference/items/Set-AWSCredential.html