99 lines
3.4 KiB
PowerShell
99 lines
3.4 KiB
PowerShell
# This script sets up AWS Roles Anywhere with a custom CA and an IAM role for Lambda invocation.
|
|
# Prerequisites:
|
|
# - AWS CLI v2 installed, configured and logged in
|
|
# - OpenSSL
|
|
#
|
|
# https://docs.aws.amazon.com/pdfs/rolesanywhere/latest/userguide/rolesanywhere-guide.pdf
|
|
#
|
|
|
|
# Variables (replace with your own values)
|
|
$AccountId = "458835642486"
|
|
$Region = "eu-west-1"
|
|
$LambdaArn = "arn:aws:lambda:eu-west-1:$AccountId:function:domainCheck"
|
|
|
|
# Paths for certs
|
|
$CertDir = Join-Path $PSScriptRoot "rolesanywhere"
|
|
New-Item -ItemType Directory -Force -Path $CertDir | Out-Null
|
|
|
|
#
|
|
$TrustPolicyFile = Join-Path $PSScriptRoot "trust-policy.json"
|
|
$LambdaPolicyFile = Join-Path $PSScriptRoot "lambda-policy.json"
|
|
|
|
function Convert-ToAwsFileUrl {
|
|
param(
|
|
[Parameter(Mandatory)]
|
|
[string]$Path
|
|
)
|
|
|
|
# Expand relative paths and resolve directory separators
|
|
$full = (Resolve-Path -LiteralPath $Path).Path
|
|
|
|
# Convert backslashes to forward slashes
|
|
$normalized = $full -replace '\\','/'
|
|
|
|
# Prepend AWS-style file scheme
|
|
"file://$normalized"
|
|
}
|
|
|
|
# Generate CA key + certificate
|
|
openssl genrsa -out "$CertDir\ca.key" 2048
|
|
openssl req -x509 -new -nodes -key "$CertDir\ca.key" -sha256 -days 365 `
|
|
-out "$CertDir\ca.pem" -subj "/CN=MyTestCA" `
|
|
-addext "basicConstraints=CA:TRUE" `
|
|
-addext "keyUsage=keyCertSign,cRLSign"
|
|
|
|
# Generate client key + certificate signed by CA
|
|
openssl genrsa -out "$CertDir\client.key" 2048
|
|
openssl req -new -key "$CertDir\client.key" -out "$CertDir\client.csr" -subj "/CN=MyPC"
|
|
openssl x509 -req -in "$CertDir\client.csr" -CA "$CertDir\ca.pem" -CAkey "$CertDir\ca.key" `
|
|
-CAcreateserial -out "$CertDir\client.pem" -days 365 -sha256
|
|
|
|
Write-Host "Certificates generated in $CertDir"
|
|
|
|
# Create Trust Anchor
|
|
$TrustAnchorArn = aws rolesanywhere create-trust-anchor `
|
|
--region $Region `
|
|
--name MyPCCA `
|
|
--source "sourceData={x509CertificateData=$(Get-Content -Raw $CertDir\ca.pem)},sourceType=CERTIFICATE_BUNDLE" `
|
|
--query 'trustAnchor.trustAnchorArn' --output text
|
|
|
|
Write-Host "Trust Anchor ARN: $TrustAnchorArn"
|
|
|
|
# Create IAM Role
|
|
$TrustPolicUrl = Convert-ToAwsFileUrl -Path $TrustPolicyFile
|
|
aws iam create-role `
|
|
--role-name DomainCheckInvokerRole `
|
|
--assume-role-policy-document $TrustPolicUrl
|
|
|
|
Write-Host "IAM Role created: DomainCheckInvokerRole"
|
|
|
|
# Attach Lambda policy
|
|
$LambdaPolicyUrl = Convert-ToAwsFileUrl -Path $LambdaPolicyFile
|
|
aws iam put-role-policy `
|
|
--role-name DomainCheckInvokerRole `
|
|
--policy-name LambdaInvokeDomainCheck `
|
|
--policy-document $LambdaPolicyUrl
|
|
|
|
Write-Host "Policy attached to role: LambdaInvokeDomainCheck"
|
|
|
|
# Create Profile
|
|
$ProfileArn = aws rolesanywhere create-profile `
|
|
--region eu-west-1 `
|
|
--name DomainCheckProfile `
|
|
--role-arns '["arn:aws:iam::458835642486:role/DomainCheckInvokerRole"]' `
|
|
--query "profile.profileArn" `
|
|
--output text
|
|
|
|
Write-Host "Profile ARN: $ProfileArn"
|
|
|
|
# Step 5: Print AWS config block
|
|
Write-Host ""
|
|
Write-Host "`nPaste the following into your AWS config (~/.aws/config):`n"
|
|
Write-Host "[profile rolesanywhere]"
|
|
Write-Host "credential_process = `"C:\path\to\aws_signing_helper.exe`" credential-process ^"
|
|
Write-Host " --certificate C:\rolesanywhere\client.pem ^"
|
|
Write-Host " --private-key C:\rolesanywhere\client.key ^"
|
|
Write-Host " --trust-anchor-arn $TrustAnchorArn ^"
|
|
Write-Host " --profile-arn $ProfileArn ^"
|
|
Write-Host " --role-arn arn:aws:iam::$AccountId:role/$RoleName"
|
|
Write-Host "region = $Region" |