Using aws-sso on remote hosts with SSH
This is intended to show how to use your aws-sso
credentials on a remote/bastion
host, without requring you to install or configure aws-sso
on that host, while maintaining
security. Additionally, when you have to authenticate via your SSO provider, that can easily
invoke your local web browser without resorting to printing and clicking on URLs.
Overview
Note: Before going any further, this document assumes you have already installed and configured aws-sso on your local system. If not, do that now. :)
Accessing one or more AWS Identity Center based IAM Roles uses the ECS Server running locally and then using ssh to forward the port to the remote host. Security is provided via a bearer token you configure on each side and all traffic is encrypted over ssh.
Warning: Running without SSL is not recommend as it may allow even a non-root user on the remote host to steal your AWS API credentials.
On your local system
- Follow the directions to enable HTTP Authentication and Encryption.
- Start the ECS Server:
- Load your selected IAM credentials into the ECS Server:
aws-sso ecs load --profile=<profile name>
- SSH to the remote system using the -R flag to forward tcp/4144:
ssh -R 4144:localhost:4144 <remotehost>
On your remote system (once you have logged in as described above)
Note: The following commands assume you are using bash
. You may have to tweak for other shells.
- Tell the AWS SDK how to talk to the ECS Server over SSH:
export AWS_CONTAINER_CREDENTIALS_FULL_URI=https://localhost:4144/
(orhttp
if you did not enable SSL) - Tell the AWS SDK the bearer token secret from the first step on your local system:
export AWS_CONTAINER_AUTHORIZATION_TOKEN='Bearer <secret>'
- Verify everything works:
aws sts get-caller-identity
See the ECS Server documentation for more information about the ECS server and how to use multiple IAM role credentials simultaneously.
Advanced Usage
The above instructions grant any host you ssh to, access to the same AWS IAM Role. But what if you want to access multiple roles?
For each role you'd like to access you will need to do two things:
- On your local host, load that role into an individual slot in the ECS Server:
aws-sso ecs load --slotted --profile <profile name>
- On the remote host, specify the correct URL:
export AWS_CONTAINER_CREDENTIALS_FULL=https://localhost:4144/slot/<profile name>