创建函数以承担PowerShell $PROFILE中的AWS STS角色

ndasle7k  于 2023-01-05  发布在  Shell
关注(0)|答案(1)|浏览(140)

我在.aws/credentials中定义了AWS凭据,如下所示:

[profile source]
aws_access_key_id=...
aws_secret_access_key=...

[profile target]
role_arn = arn:aws:iam::123412341234:role/rolename
mfa_serial = arn:aws:iam::123412341234:mfa/mylogin
source_profile = source

...

我想在我的$PROFILEassume roles中定义函数,因为MFA和凭据生命周期为1小时,所以在上述帐户中使用AWS Tools for PowerShell
函数如下所示

function Use-SomeAWS {
   Clear-AWSCredential
   $Response=(Use-STSRole arn:aws:iam::123412341234:role/rolename -ProfileName target -RoleSessionName "my email").Credentials
   $Creds=(New-AWSCredentials -AccessKey $Response.AccessKeyId -SecretKey $Response.SecretAccessKey -SessionToken $Response.SessionToken)
   Set-AWSCredential -Credential $Creds
}

复制和粘贴函数中的行可以正常工作,但是获取配置文件(. $PROFILE)和运行函数(Use-SomeAWS)需要MFA代码,并且似乎完成了它的工作,但是,没有为会话正确设置凭据。
我哪里做错了?
编辑:经过进一步的测试,如果我将-StoreAs someprofilename添加到Set-AWSCredential * 中,然后执行Set-AWSCredential -ProfileName someprofilename确实 * 有效,但这种**违背了目的。

gmxoilav

gmxoilav1#

您是否尝试了Set-AWSCredential?的-Scope,如下所示:

Set-AWSCredential -Credential $Creds -Scope global

https://docs.aws.amazon.com/powershell/latest/reference/items/Set-AWSCredential.html

相关问题