Question

我在此尝试实现的是为通过GSuite SAML Application for AWS登录的联合用户生成临时凭证（访问/密钥）。

AWS控制台设置正常并且正常运行。但是，当涉及到用于API / CLI访问的密钥时，我们必须管理另一个列表，即IAM用户，这会破坏单点登录的目的。

根据我与AWS Support的对话，我们要求SAML Response通过aws-cli生成凭据：

PID CMD TID CPU MEM IO  IOPS
151698  /usr/local/apache/bin/httpd -k start -DSSL      0%  95      
151699  /usr/local/apache/bin/httpd -k start -DSSL      0%  95      
151700  /usr/local/apache/bin/httpd -k start -DSSL      0%  95      
151703  /usr/local/apache/bin/httpd -k start -DSSL      0%  95      
151709  /usr/local/apache/bin/httpd -k start -DSSL      0%  95      
151715  /usr/local/apache/bin/httpd -k start -DSSL      0%  95      
151758  /usr/local/apache/bin/httpd -k start -DSSL      0%  97      
151760  /usr/local/apache/bin/httpd -k start -DSSL      0%  97      
156720  /usr/local/apache/bin/httpd -k start -DSSL      0%  111     
156726  /usr/local/apache/bin/httpd -k start -DSSL      0%  111     
156731  /usr/local/apache/bin/httpd -k start -DSSL      0%  111     
156737  /usr/local/apache/bin/httpd -k start -DSSL      0%  111     
156738  /usr/local/apache/bin/httpd -k start -DSSL      0%  111     
156740  /usr/local/apache/bin/httpd -k start -DSSL      0%  111     
156743  /usr/local/apache/bin/httpd -k start -DSSL      0%  111     
156757  /usr/local/apache/bin/httpd -k start -DSSL      0%  117     
156761  /usr/local/apache/bin/httpd -k start -DSSL      0%  117     
156762  /usr/local/apache/bin/httpd -k start -DSSL      0%  117     
156763  /usr/local/apache/bin/httpd -k start -DSSL      0%  117     
156777  /usr/local/apache/bin/httpd -k start -DSSL      0%  117     
156780  /usr/local/apache/bin/httpd -k start -DSSL      0%  97      
156785  /usr/local/apache/bin/httpd -k start -DSSL      0%  97      
156786  /usr/local/apache/bin/httpd -k start -DSSL      0%  97      
156792  /usr/local/apache/bin/httpd -k start -DSSL      0%  97      
156798  /usr/local/apache/bin/httpd -k start -DSSL      0%  97      
281957  /usr/local/apache/bin/httpd -k start -DSSL      0%  79      
281975  /usr/local/apache/bin/httpd -k start -DSSL      0%  79      
281978  /usr/local/apache/bin/httpd -k start -DSSL      0%  79      
281980  /usr/local/apache/bin/httpd -k start -DSSL      0%  79      
282026  /usr/local/apache/bin/httpd -k start -DSSL      0%  79      
282027  /usr/local/apache/bin/httpd -k start -DSSL      0%  79      
282032  /usr/local/apache/bin/httpd -k start -DSSL      0%  79      
282041  /usr/local/apache/bin/httpd -k start -DSSL      0%  79      
282050  /usr/local/apache/bin/httpd -k start -DSSL      0%  79      
282059  /usr/local/apache/bin/httpd -k start -DSSL      0%  79      
310847  /usr/bin/php        0%  30      
310864  /usr/bin/php        0%  30      
311101  /usr/bin/php        0%  24      
311118  /usr/bin/php        0%  24      
311158  /usr/bin/php        0%  23      
311171  /usr/bin/php        0%  22      
311223  /usr/bin/php        1%  23      
311244  /usr/bin/php        0%  22      
312142  /usr/bin/php        0%  19      
312154  /usr/bin/php        0%  19      
312214  /usr/bin/php        0%  18      
312224  /usr/bin/php        1%  18      
312263  /usr/bin/php        1%  16      
312277  /usr/bin/php        0%  16      
312352  /usr/bin/php        1%  16      
312375  /usr/bin/php        0%  16      
312440  /usr/bin/php        1%  15      
312451  /usr/bin/php        0%  15      
312474  /usr/bin/php        0%  13      
312481  /usr/bin/php        0%  13      
312950  /usr/bin/php        0%  13      
313298  /usr/bin/php        0%  13      
313331  /usr/bin/php        1%  10      
313344  /usr/bin/php        1%  10      
313377  /usr/bin/php        1%  10      
313396  /usr/bin/php        0%  10      
313427  /usr/bin/php        0%  8       
313448  /usr/bin/php        0%  8       
313491  /usr/bin/php        1%  7       
313552  /usr/bin/php        1%  7       
313601  /usr/bin/php        1%  7       
313611  /usr/bin/php        1%  5

上面的命令将生成一个带有适当凭据的JSON，如下所示：

aws sts assume-role-with-saml \
    --role-arn arn:aws:iam::000000000000:role/saml-role \
    --principal-arn arn:aws:iam::000000000000:saml-provider/GoogleApps \
    --saml-assertion "<SAML_ASSERTION>" \
    --policy '{"Version":"2012-10-17","Statement":[{"Effect":"Allow","Action":"*","Resource":"*"}]}' \
    --output json \
    --duration-seconds 28800

在上面的命令中：我们从SSO URL（LINK）获得base64编码的代码

我的主要问题是：如何通过命令行获取 SAMLResponse ，以便我可以获得自动生成凭据的脚本。

如何捕获AWS Federated Access的SAML响应

0 个答案: