{"id":92261,"date":"2020-08-25T07:42:16","date_gmt":"2020-08-25T05:42:16","guid":{"rendered":"https:\/\/prohoster.info\/blog\/administrirovanie\/aws-cli-cherez-mfa"},"modified":"2020-08-25T07:42:16","modified_gmt":"2020-08-25T05:42:16","slug":"aws-cli-cherez-mfa","status":"publish","type":"post","link":"https:\/\/prohoster.info\/nl\/blog\/administrirovanie\/aws-cli-cherez-mfa","title":{"rendered":"AWS CLI via MFA","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Hier volgt een instructie voor het instellen van AWS MFA en de daaropvolgende installatie en configuratie van AWS CLI.<\/p>\n

<\/p>\n

Helaas heeft deze verplichte procedure mij de helft van mijn werkdag gekost. Om andere onzekere AWS-gebruikers \ud83d\ude09 zoals ik zelf, niet waardevolle tijd te laten verspillen aan het triviale, besloot ik een instructie op te stellen.<\/p>\n

<\/a><\/noindex><\/p>\n

Zelfs voor een sandbox-account is de configuratie MFA<\/a><\/noindex> dit is doorgaans een verplichte eis. Bij ons is dat zo.<\/p>\n

<\/p>\n

Configuratie van MFA<\/h2>\n

<\/p>\n

    \n
  1. Installeer compatibele mobiele applicatie<\/a><\/noindex><\/li>\n
  2. Ga naar AWS-console<\/a><\/noindex><\/li>\n
  3. Mijn beveiligingsreferenties<\/a><\/noindex> -> MFA-apparaat toewijzen
    \n\"AWS<\/li>\n
  4. Virtueel MFA-apparaat
    \n\"AWS<\/li>\n
  5. Volg de instructies op het scherm
    \n\"AWS
    \n\"AWS<\/li>\n
  6. Het virtuele apparaat is klaar
    \n\"AWS<\/li>\n<\/ol>\n

    <\/p>\n

    Installatie van AWS CLI<\/h2>\n

    <\/p>\n

    https:\/\/docs.aws.amazon.com\/cli\/latest\/userguide\/install-cliv2.html<\/a><\/noindex><\/p>\n

    <\/p>\n

    Configuratie van een benoemd profiel<\/h2>\n

    <\/p>\n

    https:\/\/docs.aws.amazon.com\/cli\/latest\/userguide\/cli-configure-profiles.html<\/a><\/noindex><\/p>\n

    <\/p>\n

      \n
    1. Mijn beveiligingsreferenties<\/a><\/noindex> -> Toegangssleutel aanmaken
      \n\"AWS<\/li>\n
    2. Kopieer de sleutel naar het klembord. Deze is nodig in de volgende stap.<\/li>\n
    3. $ aws configure --profile <je profielnaam><\/code><\/li>\n<\/ol>\n

      <\/p>\n

      AWS CLI via MFA<\/h2>\n

      <\/p>\n

        \n
      1. Kopieer de ARN van het virtuele apparaat
        \n\"AWS<\/li>\n
      2. aws sts get-session-token --profile <profielnaam> --serial-number <ARN van het virtuele apparaat> --token-code <eengeldig wachtwoord><\/code>
        \nHet eengeldig wachtwoord moet uit de eerder ingestelde mobiele applicatie worden gehaald.<\/li>\n
      3. De opdracht geeft JSON weer, waarbij afzonderlijke velden moeten worden ingevoerd in de overeenkomstige omgevingsvariabelen AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY, AWS_SESSION_TOKEN.<\/li>\n<\/ol>\n

        <\/p>\n

        Ik heb besloten om te automatiseren via ~\/.bash_profile<\/code>
        \nVoor het parsen van JSON vereist dit script         jq<\/a><\/noindex>.<\/p>\n

        <\/p>\n

        #!\/usr\/bin\/env bash\n\naws_login() {\n    session=$(aws sts get-session-token "$@")\n    echo "${session}"\n    AWS_ACCESS_KEY_ID=$(echo "${session}" | jq -r '.Credentials.AccessKeyId')\n    export AWS_ACCESS_KEY_ID\n    AWS_SECRET_ACCESS_KEY=$(echo "${session}" | jq -r '.Credentials.SecretAccessKey')\n    export AWS_SECRET_ACCESS_KEY\n    AWS_SESSION_TOKEN=$(echo "${session}" | jq -r '.Credentials.SessionToken')\n    export AWS_SESSION_TOKEN\n}\n\nalias aws-login-dev='aws_login --profile <\u0438\u043c\u044f dev \u043f\u0440\u043e\u0444\u0438\u043b\u044f> --serial-number <ARN \u0432\u0438\u0440\u0442\u0443\u0430\u043b\u044c\u043d\u043e\u0433\u043e \u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432\u0430> --token-code '\nalias aws-login-prod='aws_login --profile <\u0438\u043c\u044f prod \u043f\u0440\u043e\u0444\u0438\u043b\u044f> --serial-number <ARN \u0432\u0438\u0440\u0442\u0443\u0430\u043b\u044c\u043d\u043e\u0433\u043e \u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432\u0430> --token-code '<\/code><\/pre>\n
        <\/p>\n
        Wanneer we een opmerking aan een commit schrijven (ongeacht welke tool we hiervoor gebruiken om met git te werken), kunnen we de naam van de taken in tekstvorm toevoegen (zonder aanhalingstekens of speciale symbolen zoals @).<\/p>\n
        <\/p>\n
        $ aws-login-dev <eengeldig wachtwoord><\/code><\/pre>\n
        <\/p>\n
        Hopelijk helpt deze instructie je om tijdrovende zoektochten in de offici\u00eble documentatie te vermijden. \ud83d\ude09<\/p>\n
        Bron: habr.com<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"
        \u0414\u0430\u043b\u0435\u0435 \u043f\u043e\u0441\u043b\u0435\u0434\u0443\u0435\u0442 \u0438\u043d\u0441\u0442\u0440\u0443\u043a\u0446\u0438\u044f \u043f\u043e \u043d\u0430\u0441\u0442\u0440\u043e\u0439\u043a\u0435 AWS MFA, \u0438 \u043f\u043e\u0441\u043b\u0435\u0434\u044e\u0449\u0435\u0439 \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u043a\u0435 \u0438 \u043d\u0430\u0441\u0442\u0440\u043e\u0439\u043a\u0435 AWS CLI. \u041a \u0441\u043e\u0436\u0430\u043b\u0435\u043d\u0438\u044e, \u0443 \u043c\u0435\u043d\u044f \u043d\u0430 \u044d\u0442\u0443 \u043e\u0431\u044f\u0437\u0430\u0442\u0435\u043b\u044c\u043d\u0443\u044e \u043f\u0440\u043e\u0446\u0435\u0434\u0443\u0440\u0443 \u0443\u0448\u043b\u0430 \u043f\u043e\u043b\u043e\u0432\u0438\u043d\u0430 \u0440\u0430\u0431\u043e\u0447\u0435\u0433\u043e \u0434\u043d\u044f. \u0427\u0442\u043e\u0431\u044b \u0434\u0440\u0443\u0433\u0438\u043c \u043d\u0435\u0443\u0432\u0435\u0440\u0435\u043d\u043d\u044b\u043c \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044f\u043c AWS \ud83d\ude09 \u043a\u0430\u043a \u0438 \u044f \u0441\u0430\u043c, \u043d\u0435 \u0442\u0440\u0430\u0442\u0438\u0442\u044c \u0434\u0440\u0430\u0433\u043e\u0446\u0435\u043d\u043d\u043e\u0435 \u0432\u0440\u0435\u043c\u044f \u043d\u0430 \u0431\u0430\u043d\u0430\u043b\u044c\u043d\u043e\u0435, \u0440\u0435\u0448\u0438\u043b \u0441\u043e\u0441\u0442\u0430\u0432\u0438\u0442\u044c \u0438\u043d\u0441\u0442\u0440\u0443\u043a\u0446\u0438\u044e. \u0414\u0430\u0436\u0435 \u0434\u043b\u044f sandbox \u0430\u043a\u043a\u0430\u0443\u043d\u0442\u0430 \u043d\u0430\u0441\u0442\u0440\u043e\u0439\u043a\u0430 MFA \u2014 \u044d\u0442\u043e, \u043a\u0430\u043a \u043f\u0440\u0430\u0432\u0438\u043b\u043e, […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":92262,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[688],"tags":[],"class_list":["post-92261","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-administrirovanie"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47AWS CLI via MFA | ProHoster","description":"Hier volgt een instructie voor het instellen van AWS MFA en de daaropvolgende installatie en configuratie van AWS CLI. Helaas heeft deze verplichte procedure mij de helft van mijn werkdag gekost.","canonical_url":"https:\/\/prohoster.info\/nl\/blog\/administrirovanie\/aws-cli-cherez-mfa","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"nl_NL","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47AWS CLI \u0447\u0435\u0440\u0435\u0437 MFA | ProHoster","og:description":"\u0414\u0430\u043b\u0435\u0435 \u043f\u043e\u0441\u043b\u0435\u0434\u0443\u0435\u0442 \u0438\u043d\u0441\u0442\u0440\u0443\u043a\u0446\u0438\u044f \u043f\u043e \u043d\u0430\u0441\u0442\u0440\u043e\u0439\u043a\u0435 AWS MFA, \u0438 \u043f\u043e\u0441\u043b\u0435\u0434\u044e\u0449\u0435\u0439 \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u043a\u0435 \u0438 \u043d\u0430\u0441\u0442\u0440\u043e\u0439\u043a\u0435 AWS CLI. \u041a \u0441\u043e\u0436\u0430\u043b\u0435\u043d\u0438\u044e, \u0443 \u043c\u0435\u043d\u044f \u043d\u0430 \u044d\u0442\u0443 \u043e\u0431\u044f\u0437\u0430\u0442\u0435\u043b\u044c\u043d\u0443\u044e \u043f\u0440\u043e\u0446\u0435\u0434\u0443\u0440\u0443 \u0443\u0448\u043b\u0430 \u043f\u043e\u043b\u043e\u0432\u0438\u043d\u0430 \u0440\u0430\u0431\u043e\u0447\u0435\u0433\u043e \u0434\u043d\u044f.","og:url":"https:\/\/prohoster.info\/nl\/blog\/administrirovanie\/aws-cli-cherez-mfa","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2020-08-25T05:42:16+00:00","article:modified_time":"2020-08-25T05:42:16+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"92261","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 12:11:28","updated":"2022-10-03 19:03:06","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/nl\/wp-json\/wp\/v2\/posts\/92261","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/nl\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/nl\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/nl\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/nl\/wp-json\/wp\/v2\/comments?post=92261"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/nl\/wp-json\/wp\/v2\/posts\/92261\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/nl\/wp-json\/wp\/v2\/media\/92262"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/nl\/wp-json\/wp\/v2\/media?parent=92261"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/nl\/wp-json\/wp\/v2\/categories?post=92261"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/nl\/wp-json\/wp\/v2\/tags?post=92261"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}