initial commit

2026-08-07 20:35:20 +05:30
commit 7d477888a5
9 changed files with 176 additions and 0 deletions
@@ -0,0 +1,99 @@
+# This script sets up AWS Roles Anywhere with a custom CA and an IAM role for Lambda invocation.
+# Prerequisites:
+# - AWS CLI v2 installed, configured and logged in
+# - OpenSSL
+#
+# https://docs.aws.amazon.com/pdfs/rolesanywhere/latest/userguide/rolesanywhere-guide.pdf
+#
+
+# Variables (replace with your own values)
+$AccountId = "458835642486"
+$Region    = "eu-west-1"
+$LambdaArn = "arn:aws:lambda:eu-west-1:$AccountId:function:domainCheck"
+
+# Paths for certs
+$CertDir = Join-Path $PSScriptRoot "rolesanywhere"
+New-Item -ItemType Directory -Force -Path $CertDir | Out-Null
+
+#
+$TrustPolicyFile = Join-Path $PSScriptRoot "trust-policy.json"
+$LambdaPolicyFile = Join-Path $PSScriptRoot "lambda-policy.json"
+
+function Convert-ToAwsFileUrl {
+    param(
+        [Parameter(Mandatory)]
+        [string]$Path
+    )
+
+    # Expand relative paths and resolve directory separators
+    $full = (Resolve-Path -LiteralPath $Path).Path
+
+    # Convert backslashes to forward slashes
+    $normalized = $full -replace '\\','/'
+
+    # Prepend AWS-style file scheme
+    "file://$normalized"
+}
+
+# Generate CA key + certificate
+openssl genrsa -out "$CertDir\ca.key" 2048
+openssl req -x509 -new -nodes -key "$CertDir\ca.key" -sha256 -days 365 `
+  -out "$CertDir\ca.pem" -subj "/CN=MyTestCA" `
+  -addext "basicConstraints=CA:TRUE" `
+  -addext "keyUsage=keyCertSign,cRLSign"
+
+# Generate client key + certificate signed by CA
+openssl genrsa -out "$CertDir\client.key" 2048
+openssl req -new -key "$CertDir\client.key" -out "$CertDir\client.csr" -subj "/CN=MyPC"
+openssl x509 -req -in "$CertDir\client.csr" -CA "$CertDir\ca.pem" -CAkey "$CertDir\ca.key" `
+  -CAcreateserial -out "$CertDir\client.pem" -days 365 -sha256
+
+Write-Host "Certificates generated in $CertDir"
+
+# Create Trust Anchor
+$TrustAnchorArn = aws rolesanywhere create-trust-anchor `
+  --region $Region `
+  --name MyPCCA `
+  --source "sourceData={x509CertificateData=$(Get-Content -Raw $CertDir\ca.pem)},sourceType=CERTIFICATE_BUNDLE" `
+  --query 'trustAnchor.trustAnchorArn' --output text
+
+Write-Host "Trust Anchor ARN: $TrustAnchorArn"
+
+# Create IAM Role
+$TrustPolicUrl = Convert-ToAwsFileUrl -Path $TrustPolicyFile
+aws iam create-role `
+  --role-name DomainCheckInvokerRole `
+  --assume-role-policy-document $TrustPolicUrl
+
+Write-Host "IAM Role created: DomainCheckInvokerRole"
+
+# Attach Lambda policy
+$LambdaPolicyUrl = Convert-ToAwsFileUrl -Path $LambdaPolicyFile
+aws iam put-role-policy `
+  --role-name DomainCheckInvokerRole `
+  --policy-name LambdaInvokeDomainCheck `
+  --policy-document $LambdaPolicyUrl
+
+Write-Host "Policy attached to role: LambdaInvokeDomainCheck"
+
+# Create Profile
+$ProfileArn = aws rolesanywhere create-profile `
+  --region eu-west-1 `
+  --name DomainCheckProfile `
+  --role-arns '["arn:aws:iam::458835642486:role/DomainCheckInvokerRole"]' `
+  --query "profile.profileArn" `
+  --output text
+
+Write-Host "Profile ARN: $ProfileArn"
+
+# Step 5: Print AWS config block
+Write-Host ""
+Write-Host "`nPaste the following into your AWS config (~/.aws/config):`n"
+Write-Host "[profile rolesanywhere]"
+Write-Host "credential_process = `"C:\path\to\aws_signing_helper.exe`" credential-process ^"
+Write-Host "  --certificate C:\rolesanywhere\client.pem ^"
+Write-Host "  --private-key C:\rolesanywhere\client.key ^"
+Write-Host "  --trust-anchor-arn $TrustAnchorArn ^"
+Write-Host "  --profile-arn $ProfileArn ^"
+Write-Host "  --role-arn arn:aws:iam::$AccountId:role/$RoleName"
+Write-Host "region = $Region"