是否可以从 AWS CLI 打开 AWS 管理控制台网站？

Question

假设我使用特定账户登录到我的 AWS CLI 工具，我可以执行类似

的命令

aws ecr describe-repositories

是否有 AWS CLI 命令可以在默认浏览器上打开 AWS 管理控制台网站，并已登录同一账户？

例如：类似

aws web

谢谢！

Answer 1

这不存在。用于 AWS CLI 和 Console 访问的凭据不同。

对于 CLI，您使用 Access key 和 Secret key。

对于 Console 访问（通过网络浏览器），您使用 username 和 password。

您可能在 AWS 账户中拥有 programmatic access 但没有 console access。

Answer 2

虽然aws cli中没有内置这样的cli命令。如果用户具有有效的 STS 会话 IAM 凭证（访问密钥和秘密密钥），您可以为他们提供对 AWS 管理控制台的直接访问权限。您可以阅读有关使用 getSigninToken 操作生成 pre-signed AWS 控制台 URL 以换取您的 IAM 凭据 here.

的过程

python 代码示例

import urllib, json, sys
import requests # 'pip install requests'
import boto3 # AWS SDK for Python (Boto3) 'pip install boto3'

# Step 1: Authenticate user in your own identity system.

# Step 2: Using the access keys for an IAM user in your AWS account,
# call "AssumeRole" to get temporary access keys for the federated user

# Note: Calls to AWS STS AssumeRole must be signed using the access key ID 
# and secret access key of an IAM user or using existing temporary credentials.
# The credentials can be in Amazon EC2 instance metadata, in environment variables, 
# or in a configuration file, and will be discovered automatically by the 
# client('sts') function. For more information, see the Python SDK docs:
# http://boto3.readthedocs.io/en/latest/reference/services/sts.html
# http://boto3.readthedocs.io/en/latest/reference/services/sts.html#STS.Client.assume_role
sts_connection = boto3.client('sts')

assumed_role_object = sts_connection.assume_role(
    RoleArn="arn:aws:iam::account-id:role/ROLE-NAME",
    RoleSessionName="AssumeRoleSession",
)

# Step 3: Format resulting temporary credentials into JSON
url_credentials = {}
url_credentials['sessionId'] = assumed_role_object.get('Credentials').get('AccessKeyId')
url_credentials['sessionKey'] = assumed_role_object.get('Credentials').get('SecretAccessKey')
url_credentials['sessionToken'] = assumed_role_object.get('Credentials').get('SessionToken')
json_string_with_temp_credentials = json.dumps(url_credentials)

# Step 4. Make request to AWS federation endpoint to get sign-in token. Construct the parameter string with
# the sign-in action request, a 12-hour session duration, and the JSON document with temporary credentials 
# as parameters.
request_parameters = "?Action=getSigninToken"
request_parameters += "&SessionDuration=43200"
if sys.version_info[0] < 3:
    def quote_plus_function(s):
        return urllib.quote_plus(s)
else:
    def quote_plus_function(s):
        return urllib.parse.quote_plus(s)
request_parameters += "&Session=" + quote_plus_function(json_string_with_temp_credentials)
request_url = "https://signin.aws.amazon.com/federation" + request_parameters
r = requests.get(request_url)
# Returns a JSON document with a single element named SigninToken.
signin_token = json.loads(r.text)

# Step 5: Create URL where users can use the sign-in token to sign in to 
# the console. This URL must be used within 15 minutes after the
# sign-in token was issued.
request_parameters = "?Action=login" 
request_parameters += "&Issuer=Example.org" 
request_parameters += "&Destination=" + quote_plus_function("https://console.aws.amazon.com/")
request_parameters += "&SigninToken=" + signin_token["SigninToken"]
request_url = "https://signin.aws.amazon.com/federation" + request_parameters

# Send final URL to stdout
print (request_url)

我在那些日子里也写过 AWS 插件，它完全符合您的需要，但它不适用于 aws cli v2

https://github.com/b-b3rn4rd/awscli-console-plugin

是否可以从 AWS CLI 打开 AWS 管理控制台网站？

Is it possible to open the AWS Management Console website from AWS CLI?

amazon-web-services

aws-cli