Use IAM Roles Anywhere to reduce the use of IAM keys
Tags: aws, iam, cloud, security
Published: 2023-11-06 00:34:17

<!-- wp:heading -->
<h2 class="wp-block-heading">Abstract</h2>
<!-- /wp:heading -->

<!-- wp:paragraph -->
<p>Exposed static IAM keys are one of the most common security risks for AWS accounts.  Avoiding the use of static keys is a best practice that can be hard to achieve in hybrid cloud environments where access needs to be given to external systems.   IAM Roles Anywhere is a service that help mitigate this risk.  In this article I detail the problems and risk associated with static keys, how IAM Roles Anywhere can solve this problem, and walk through how to setup the complete solution.</p>
<!-- /wp:paragraph -->

<!-- wp:aioseo/table-of-contents {"headings":[{"id":3,"blockClientId":"25825a40-547f-4535-93d5-9d41b01d860d","content":"The Keys Problem","level":2,"anchor":"aioseo-the-keys-problem","order":0,"editedContent":"","editedLevel":0,"editedOrder":0,"hidden":false,"headings":[{"id":5,"blockClientId":"4b158fa0-a0c3-4d52-aa52-829d27a7ab30","content":"Why this is bad","level":4,"anchor":"aioseo-why-this-is-bad","order":1,"editedContent":"","editedLevel":0,"editedOrder":0,"hidden":false,"headings":[]},{"id":8,"blockClientId":"89e73d36-da6a-4106-aeed-0cddfef7d9a4","content":"The Toil of Managing Keys","level":4,"anchor":"aioseo-the-toil-of-managing-keys","order":2,"editedContent":"","editedLevel":0,"editedOrder":0,"hidden":false,"headings":[]},{"id":10,"blockClientId":"0bf74330-0bb6-437b-a2ea-27d55390e4a9","content":"What about IAM Instance Roles?","level":4,"anchor":"aioseo-no-solution-for-external-systems","order":3,"editedContent":"","editedLevel":0,"editedOrder":0,"hidden":false,"headings":[]},{"id":12,"blockClientId":"bc9ffca8-f44c-42eb-98db-f16b5ac355a6","content":"No Solution for External Systems","level":4,"anchor":"aioseo-no-solution-for-external-systems","order":4,"editedContent":"","editedLevel":0,"editedOrder":0,"hidden":false,"headings":[]}]},{"id":14,"blockClientId":"0f4093b5-e7f8-49f2-8be6-3489dbfeb225","content":"IAM Roles Anywhere Solves the Keys Problem","level":2,"anchor":"aioseo-what-is-iam-roles-anywhere-and-how-does-it-work","order":5,"editedContent":"","editedLevel":0,"editedOrder":0,"hidden":false,"headings":[]},{"id":16,"blockClientId":"6455a47e-58f7-4b1a-9789-c04dad6fdd62","content":"How does IAM Roles Anywhere Work?","level":2,"anchor":"aioseo-how-does-iam-roles-anywhere-work","order":6,"editedContent":"","editedLevel":0,"editedOrder":0,"hidden":false,"headings":[{"id":18,"blockClientId":"37c2c9e7-6ae5-4e84-ad74-ab3493464018","content":"IAM Roles Anywhere Components","level":3,"anchor":"aioseo-iam-roles-anywhere-components","order":7,"editedContent":"","editedLevel":0,"editedOrder":0,"hidden":false,"headings":[]},{"id":21,"blockClientId":"f32fc1e5-2376-43e3-b8d8-e54c3181a7ab","content":"IAM Roles Anywhere Architecture","level":3,"anchor":"aioseo-iam-roles-anywhere-architecture","order":8,"editedContent":"","editedLevel":0,"editedOrder":0,"hidden":false,"headings":[]}]},{"id":26,"blockClientId":"48c16423-bb99-4dfe-8afb-65537c9934fb","content":"Setting Up IAM Roles Anywhere","level":2,"anchor":"aioseo-setting-it-up","order":9,"editedContent":"","editedLevel":0,"editedOrder":0,"hidden":false,"headings":[{"id":28,"blockClientId":"314fb6e8-aa74-401b-af8d-b22f0a777f22","content":"Setup AWS Certificate Manager Private CA","level":3,"anchor":"aioseo-setup-aws-certificate-manager-private-ca","order":10,"editedContent":"","editedLevel":0,"editedOrder":0,"hidden":false,"headings":[{"id":30,"blockClientId":"3064a71a-1f2b-4d31-a4df-77e353f6ef62","content":"Steps to Setup the Root CA","level":4,"anchor":"aioseo-steps-to-setup-the-root-ca","order":11,"editedContent":"","editedLevel":0,"editedOrder":0,"hidden":false,"headings":[]},{"id":37,"blockClientId":"3a352281-3159-4d82-b972-77338d5f8cbc","content":"Important Note on CA Hierarchies","level":4,"anchor":"aioseo-important-note","order":12,"editedContent":"","editedLevel":0,"editedOrder":0,"hidden":false,"headings":[]}]},{"id":39,"blockClientId":"c4b5e355-4542-4e7e-a34c-462b38c205ed","content":"Configure IAM Roles Anywhere","level":3,"anchor":"aioseo-configure-iam-roles-anywhere","order":13,"editedContent":"","editedLevel":0,"editedOrder":0,"hidden":false,"headings":[{"id":42,"blockClientId":"a72c3ee3-1121-4763-8dbd-b7b3f1a6a6ff","content":"Establish Trust Anchor","level":4,"anchor":"aioseo-establish-trust-anchor","order":14,"editedContent":"","editedLevel":0,"editedOrder":0,"hidden":false,"headings":[]},{"id":46,"blockClientId":"393ed204-3064-4584-9249-031d1d4fe6ff","content":"Configure Role","level":4,"anchor":"aioseo-configure-role","order":15,"editedContent":"","editedLevel":0,"editedOrder":0,"hidden":false,"headings":[]},{"id":52,"blockClientId":"5ff2ba51-72e5-4763-b23a-97e718a86a18","content":"Configure a Profile","level":4,"anchor":"aioseo-configure-a-profile","order":16,"editedContent":"","editedLevel":0,"editedOrder":0,"hidden":false,"headings":[]}]}]},{"id":57,"blockClientId":"e04afdac-561b-453b-8b6e-9009b6cea08b","content":"Configuring the External System","level":2,"anchor":"aioseo-configuring-the-external-system","order":17,"editedContent":"","editedLevel":0,"editedOrder":0,"hidden":false,"headings":[{"id":59,"blockClientId":"909ce347-1e18-42d5-b206-8b84eaaa4230","content":"Generate Client Certificate","level":3,"anchor":"aioseo-generate-client-certificate","order":18,"editedContent":"","editedLevel":0,"editedOrder":0,"hidden":false,"headings":[]},{"id":65,"blockClientId":"2d8ed3e0-bbb5-4093-9d5d-feca927da59a","content":"Export the Certificate","level":3,"anchor":"aioseo-export-the-certificate","order":19,"editedContent":"","editedLevel":0,"editedOrder":0,"hidden":false,"headings":[]},{"id":73,"blockClientId":"b3b22a70-8101-4c34-9e03-004fe6bff04f","content":"Decrypt the Private Key","level":3,"anchor":"aioseo-decrypt-the-private-key","order":20,"editedContent":"","editedLevel":0,"editedOrder":0,"hidden":false,"headings":[]},{"id":79,"blockClientId":"6a2101d1-4416-4344-84e3-1685deec01b4","content":"Install IAM Credentials Helper","level":3,"anchor":"aioseo-install-iam-credentials-helper","order":21,"editedContent":"","editedLevel":0,"editedOrder":0,"hidden":false,"headings":[]}]},{"id":83,"blockClientId":"d0bb8bdc-a1ec-4544-827e-40d15fa037b3","content":"Making the Connection","level":2,"anchor":"aioseo-making-the-connection","order":22,"editedContent":"","editedLevel":0,"editedOrder":0,"hidden":false,"headings":[{"id":87,"blockClientId":"f7e04863-e0b7-431f-8f45-7a5380c334ae","content":"Manually request and set credentials","level":3,"anchor":"aioseo-manually-request-and-set-credentials","order":23,"editedContent":"","editedLevel":0,"editedOrder":0,"hidden":false,"headings":[]},{"id":97,"blockClientId":"c584492a-b96b-43da-9206-c08375e962e5","content":"Leverage Roles Anywhere in AWS CLI Config","level":3,"anchor":"aioseo-leverage-roles-anywhere-in-aws-cli-config","order":24,"editedContent":"","editedLevel":0,"editedOrder":0,"hidden":false,"headings":[]}]},{"id":103,"blockClientId":"bc2532d0-5427-4ef2-ba9f-0c684a8c271c","content":"Closing Thoughts","level":2,"anchor":"aioseo-closing-thoughts","order":25,"editedContent":"","editedLevel":0,"editedOrder":0,"hidden":false,"headings":[]},{"id":107,"blockClientId":"e9b3ef16-5410-4198-8ffc-1e87622e2b93","content":"References","level":2,"anchor":"aioseo-references","order":26,"editedContent":"","editedLevel":0,"editedOrder":0,"hidden":false,"headings":[]}]} -->
<div class="wp-block-aioseo-table-of-contents"><ul><li><a href="#aioseo-the-keys-problem">The Keys Problem</a><ul><li><a href="#aioseo-why-this-is-bad">Why this is bad</a></li><li><a href="#aioseo-the-toil-of-managing-keys">The Toil of Managing Keys</a></li><li><a href="#aioseo-no-solution-for-external-systems">What about IAM Instance Roles?</a></li><li><a href="#aioseo-no-solution-for-external-systems">No Solution for External Systems</a></li></ul></li><li><a href="#aioseo-what-is-iam-roles-anywhere-and-how-does-it-work">IAM Roles Anywhere Solves the Keys Problem</a></li><li><a href="#aioseo-how-does-iam-roles-anywhere-work">How does IAM Roles Anywhere Work?</a><ul><li><a href="#aioseo-iam-roles-anywhere-components">IAM Roles Anywhere Components</a></li><li><a href="#aioseo-iam-roles-anywhere-architecture">IAM Roles Anywhere Architecture</a></li></ul></li><li><a href="#aioseo-setting-it-up">Setting Up IAM Roles Anywhere</a><ul><li><a href="#aioseo-setup-aws-certificate-manager-private-ca">Setup AWS Certificate Manager Private CA</a><ul><li><a href="#aioseo-steps-to-setup-the-root-ca">Steps to Setup the Root CA</a></li><li><a href="#aioseo-important-note">Important Note on CA Hierarchies</a></li></ul></li><li><a href="#aioseo-configure-iam-roles-anywhere">Configure IAM Roles Anywhere</a><ul><li><a href="#aioseo-establish-trust-anchor">Establish Trust Anchor</a></li><li><a href="#aioseo-configure-role">Configure Role</a></li><li><a href="#aioseo-configure-a-profile">Configure a Profile</a></li></ul></li></ul></li><li><a href="#aioseo-configuring-the-external-system">Configuring the External System</a><ul><li><a href="#aioseo-generate-client-certificate">Generate Client Certificate</a></li><li><a href="#aioseo-export-the-certificate">Export the Certificate</a></li><li><a href="#aioseo-decrypt-the-private-key">Decrypt the Private Key</a></li><li><a href="#aioseo-install-iam-credentials-helper">Install IAM Credentials Helper</a></li></ul></li><li><a href="#aioseo-making-the-connection">Making the Connection</a><ul><li><a href="#aioseo-manually-request-and-set-credentials">Manually request and set credentials</a></li><li><a href="#aioseo-leverage-roles-anywhere-in-aws-cli-config">Leverage Roles Anywhere in AWS CLI Config</a></li></ul></li><li><a href="#aioseo-closing-thoughts">Closing Thoughts</a></li><li><a href="#aioseo-references">References</a></li></ul></div>
<!-- /wp:aioseo/table-of-contents -->

<!-- wp:heading -->
<h2 class="wp-block-heading" id="aioseo-the-keys-problem">The Keys Problem</h2>
<!-- /wp:heading -->

<!-- wp:paragraph -->
<p>One of the more pesky problems to solve when managing an AWS environment is granting access to external systems in a secure manner.   External access to the AWS console can be handled via username and password (or even better, leverage SSO login via IAM Identity Center!).  Unfortunately, this method doesn't work for API access from machines and applications outside your AWS environment.</p>
<!-- /wp:paragraph -->

<!-- wp:heading {"level":4} -->
<h4 class="wp-block-heading" id="aioseo-why-this-is-bad">Why this is bad</h4>
<!-- /wp:heading -->

<!-- wp:paragraph -->
<p>The most common solution for providing external access is not awesome.  You generate an IAM access key pair for the application or system and pass those credentials over to your developer for use.  Afterwords, you keep your fingers crossed that they do not share these keys with other folks or store them in plain text on their computer.  Even worse would be if they put these credentials directly into their code and then commit it to a git repo.   </p>
<!-- /wp:paragraph -->

<!-- wp:paragraph -->
<p>Without a doubt this last scenario happens all the time, and consequently it is something that hackers are constantly scanning GitHub repos to find and exploit to get access to your AWS accounts.</p>
<!-- /wp:paragraph -->

<!-- wp:heading {"level":4} -->
<h4 class="wp-block-heading" id="aioseo-the-toil-of-managing-keys">The Toil of Managing Keys</h4>
<!-- /wp:heading -->

<!-- wp:paragraph -->
<p>Let's say you are able to avoid these credentials getting exposed accidentally.  You still have to make sure you are performing good security practices on these keys by rotating them regularly.  For example, in my environment we rotate keys every 75 days.  Then you have to go through the process of securely exchanging the keys with your developers again, and they have to update their application to use the new keys.  Wash, rinse, and repeat this process every few months and that adds up to a lot of toil just to keep your keys secure.</p>
<!-- /wp:paragraph -->

<!-- wp:heading {"level":4} -->
<h4 class="wp-block-heading" id="aioseo-no-solution-for-external-systems">What about IAM Instance Roles?</h4>
<!-- /wp:heading -->

<!-- wp:paragraph -->
<p>This problem has been solved for years for systems running <strong>inside</strong> of AWS with <a href="https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/iam-roles-for-amazon-ec2.html" target="_blank" rel="noopener" title="">IAM Instance Roles</a>.  This feature allows you to assign an IAM Role directly to an EC2 instance (or container or Lambda function).  As a result, the EC2 instance then dynamically retrieves an access token for the role via the EC2 Instance Metadata service.  Very slick and no static keys required! </p>
<!-- /wp:paragraph -->

<!-- wp:heading {"level":4} -->
<h4 class="wp-block-heading" id="aioseo-no-solution-for-external-systems">No Solution for External Systems</h4>
<!-- /wp:heading -->

<!-- wp:paragraph -->
<p>However, the very nature of the way this service works requires that the calling system be inside AWS.   For external systems you had no option beyond static keys.  Thankfully, that all changed in July 2022 when AWS announced <a href="https://aws.amazon.com/blogs/security/extend-aws-iam-roles-to-workloads-outside-of-aws-with-iam-roles-anywhere/" target="_blank" rel="noopener" title="">IAM Roles Anywhere</a>.  </p>
<!-- /wp:paragraph -->

<!-- wp:heading -->
<h2 class="wp-block-heading" id="aioseo-what-is-iam-roles-anywhere-and-how-does-it-work">IAM Roles Anywhere Solves the Keys Problem</h2>
<!-- /wp:heading -->

<!-- wp:paragraph -->
<p>IAM Roles Anywhere makes it possible to use IAM Roles on systems outside of AWS.  It provides a mechanism for external servers, containers, and applications to obtain temporary AWS credentials in a manner similar to EC2 Instance Roles.   Thus it eliminates the need to create and manage static access keys and dramatically improves the security posture of your AWS accounts.</p>
<!-- /wp:paragraph -->

<!-- wp:heading -->
<h2 class="wp-block-heading" id="aioseo-how-does-iam-roles-anywhere-work">How does IAM Roles Anywhere Work?</h2>
<!-- /wp:heading -->

<!-- wp:paragraph -->
<p>IAM Roles Anywhere leverages public key infrastructure (PKI) as a mechanism to establish trust between your external system and your AWS Account.   Systems sitting outside of AWS hold X.509 Certificates that they present as part of a CreateSession request.   Next these certificates are validated by IAM Roles Anywhere and then a temporary set of credentials are returned to the client. </p>
<!-- /wp:paragraph -->

<!-- wp:heading {"level":3} -->
<h3 class="wp-block-heading" id="aioseo-iam-roles-anywhere-components">IAM Roles Anywhere Components</h3>
<!-- /wp:heading -->

<!-- wp:paragraph -->
<p>There are six basic components to the IAM Roles Anywhere architecture.</p>
<!-- /wp:paragraph -->

<!-- wp:list -->
<ul><!-- wp:list-item -->
<li><strong><a href="https://en.wikipedia.org/wiki/Certificate_authority" title="">Certificate Authority (CA)</a></strong>.  The CA is the heart of your public key infrastructure and is responsible for issuing certificates.  For IAM Roles Anywhere you can use a CA provided by Amazon Certificate Manager, or you can <a href="https://aws.amazon.com/blogs/security/iam-roles-anywhere-with-an-external-certificate-authority/" target="_blank" rel="noopener" title="">use an existing External CA</a>.</li>
<!-- /wp:list-item -->

<!-- wp:list-item -->
<li><strong><a href="https://en.wikipedia.org/wiki/X.509" target="_blank" rel="noopener" title="">Certificates</a></strong> are digital documents that securely associate cryptographic key pairs with a system.  A certificate contains the public key and a signature that has been encrypted with the private key.  This allows a third party to verify that a certificate is valid by decrypting the signature using the public key.  Certificates also contain a trust chain that links the certificate back to the CA that issued it.  </li>
<!-- /wp:list-item -->

<!-- wp:list-item -->
<li>A <strong>Trust Anchor</strong> is used to establish a trust relationship between IAM Roles Anywhere and your Certificate Authority.</li>
<!-- /wp:list-item -->

<!-- wp:list-item -->
<li>An <strong>IAM Role</strong>. You probably already know that a <a style="font-weight: bold;" href="https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles.html" target="_blank" rel="noopener" title="">Role</a> is an IAM identity that contains specific permissions you wish to grant and that can be assumed by anyone who needs it.   In order to use a role with IAM Roles Anywhere, your role must be configured to trust the IAM Roles Anywhere service principal.</li>
<!-- /wp:list-item -->

<!-- wp:list-item -->
<li><strong>Profiles</strong> are used to specify which roles IAM Roles Anywhere can assume and what your workloads can do with the temporary credentials that are issued.  You can specify a session policy to limit the permissions created for the session.</li>
<!-- /wp:list-item -->

<!-- wp:list-item -->
<li>Lastly, the <strong><a href="https://docs.aws.amazon.com/rolesanywhere/latest/userguide/credential-helper.html" target="_blank" rel="noopener" title="">IAM Roles Credential Helper</a></strong> is a downloadable tool provided by AWS that allows you to request temporary security credentials via the CreateSession API.</li>
<!-- /wp:list-item --></ul>
<!-- /wp:list -->

<!-- wp:heading {"level":3} -->
<h3 class="wp-block-heading" id="aioseo-iam-roles-anywhere-architecture">IAM Roles Anywhere Architecture</h3>
<!-- /wp:heading -->

<!-- wp:paragraph -->
<p>Here is a diagram that illustrates the components of the IAM Roles Architecture:</p>
<!-- /wp:paragraph -->

<!-- wp:image {"id":1044,"sizeSlug":"large","linkDestination":"none"} -->
<figure class="wp-block-image size-large"><img src="https://cloudyadvice.com/wp-content/uploads/2023/11/IAM-Roles-Anywhere-Architecture-3-1024x575.png" alt="A an architecture diagram showing the IAM Roles Anywhere solution components and their relationships" class="wp-image-1044"/></figure>
<!-- /wp:image -->

<!-- wp:paragraph -->
<p>The components of the architecture work together in the following way:</p>
<!-- /wp:paragraph -->

<!-- wp:list {"ordered":true} -->
<ol><!-- wp:list-item -->
<li>A Trust Anchor is established between IAM Roles Anywhere and the Certificate Authority (CA).  This CA can be running inside of AWS or externally in your own data center or even another cloud provider.</li>
<!-- /wp:list-item -->

<!-- wp:list-item -->
<li>The CA issues an x.509 Certificate to the external system, where it is installed in the local store.</li>
<!-- /wp:list-item -->

<!-- wp:list-item -->
<li>The IAM Role is created and configured to trust the IAM Roles Anywhere service principal.</li>
<!-- /wp:list-item -->

<!-- wp:list-item -->
<li>A Roles Anywhere Profile associates the IAM Role with Roles Anywhere and can set session restrictions if desired.</li>
<!-- /wp:list-item -->

<!-- wp:list-item -->
<li>The External Server issues a CreateSession request and provides it's Certificate along with specifying the role it wishes to assume.</li>
<!-- /wp:list-item -->

<!-- wp:list-item -->
<li>IAM Roles Anywhere validates the Certificate is valid and tied to the CA contained in the trust anchor.</li>
<!-- /wp:list-item -->

<!-- wp:list-item -->
<li>Once these validations are complete, the system is now authenticated and IAM Roles Anywhere will create a role session via STS and pass the session credentials back to the external system.</li>
<!-- /wp:list-item -->

<!-- wp:list-item -->
<li>The external system can now use these temporary credentials to make any AWS API calls that are allowed in the IAM Role.</li>
<!-- /wp:list-item --></ol>
<!-- /wp:list -->

<!-- wp:heading -->
<h2 class="wp-block-heading" id="aioseo-setting-it-up">Setting Up IAM Roles Anywhere</h2>
<!-- /wp:heading -->

<!-- wp:paragraph -->
<p>Now that I've gone over the basic architecture of IAM Roles Anywhere, next I'm going to walk you through an end to end deployment of this solution.  For my lab deployment I will use AWS Certificate Manager Private CA as our Certificate Authority.   As a result the first thing I will walk through is how to stand up the Private CA.</p>
<!-- /wp:paragraph -->

<!-- wp:heading {"level":3} -->
<h3 class="wp-block-heading" id="aioseo-setup-aws-certificate-manager-private-ca">Setup AWS Certificate Manager Private CA</h3>
<!-- /wp:heading -->

<!-- wp:paragraph -->
<p>AWS Certificate Manager is AWS' fully managed Certificate Authority service.   You are probably most familiar with this service as a method for issuing public certificates for use with other services like CloudFront and API Gateway, but the service also has the capability to act as a <a href="https://docs.aws.amazon.com/privateca/latest/userguide/PcaWelcome.html" target="_blank" rel="noopener" title="">Private CA</a>, allowing you to setup entire managed CA hierarchies without the headache of managing your own CA (and trust me, having setup my own private PKI hierarchies in the past, it neither fun to setup nor maintain).  </p>
<!-- /wp:paragraph -->

<!-- wp:heading {"level":4} -->
<h4 class="wp-block-heading" id="aioseo-steps-to-setup-the-root-ca">Steps to Setup the Root CA</h4>
<!-- /wp:heading -->

<!-- wp:media-text {"mediaPosition":"right","mediaId":1010,"mediaLink":"https://cloudyadvice.com/?attachment_id=1010","mediaType":"image"} -->
<div class="wp-block-media-text has-media-on-the-right is-stacked-on-mobile"><div class="wp-block-media-text__content"><!-- wp:paragraph {"placeholder":"Content…"} -->
<p>First, we need to setup the Root CA</p>
<!-- /wp:paragraph -->

<!-- wp:paragraph -->
<p>To get started, login to your AWS account with the appropriate credentials and navigate to the <strong>Certificate Manager</strong> service. From the Certificate Manager home page, click the link for <strong>AWS Private CA</strong> on the left hand navigation bar</p>
<!-- /wp:paragraph --></div><figure class="wp-block-media-text__media"><img src="https://cloudyadvice.com/wp-content/uploads/2023/11/certificate-manager-launch-private-CA-2.jpg" alt="AWS Certificate Manager home page with link to AWS Private Certificate Authority " class="wp-image-1010 size-full"/></figure></div>
<!-- /wp:media-text -->

<!-- wp:media-text {"mediaPosition":"right","mediaId":1011,"mediaLink":"https://cloudyadvice.com/?attachment_id=1011","mediaType":"image"} -->
<div class="wp-block-media-text has-media-on-the-right is-stacked-on-mobile"><div class="wp-block-media-text__content"><!-- wp:paragraph {"placeholder":"Content…"} -->
<p>On the resulting page, click the orange <strong>Create a Private CA</strong> button to get started creating your new Private CA.</p>
<!-- /wp:paragraph --></div><figure class="wp-block-media-text__media"><img src="https://cloudyadvice.com/wp-content/uploads/2023/11/Create_a_Private_CA_button.jpg" alt="AWS Private Certificate Authority Create a Private CA button" class="wp-image-1011 size-full"/></figure></div>
<!-- /wp:media-text -->

<!-- wp:media-text {"mediaId":1012,"mediaLink":"https://cloudyadvice.com/?attachment_id=1012","mediaType":"image","mediaWidth":59} -->
<div class="wp-block-media-text is-stacked-on-mobile" style="grid-template-columns:59% auto"><figure class="wp-block-media-text__media"><img src="https://cloudyadvice.com/wp-content/uploads/2023/11/create-root-ca-part1-531x1024.jpg" alt="AWS Private Certificate Authority Create a Certificate Authority Wizard with CA Type, Subject DN and Key Algorithm settings." class="wp-image-1012 size-full"/></figure><div class="wp-block-media-text__content"><!-- wp:paragraph -->
<p>After clicking the button, you will be presented with the <strong>Create a private certificate authority</strong> wizard page.  Here we will be configuring all the required options to stand up our private Certificate Authority.    </p>
<!-- /wp:paragraph -->

<!-- wp:list -->
<ul><!-- wp:list-item -->
<li>For your CA Mode options, select <strong>General Purpose</strong>.  NOTE: if you are following along and setting this up in a lab environment be aware of <a href="https://aws.amazon.com/private-ca/pricing/" target="_blank" rel="noopener" title="">Amazon Private CA pricing</a>.   A General Purpose private CA will cost you $400/month!  I have not tested the option to use the short-lived certificate mode, and it certainly would not work for a production deployment as the certificates would expire too quickly. </li>
<!-- /wp:list-item -->

<!-- wp:list-item -->
<li>For CA type, select <strong>Root</strong></li>
<!-- /wp:list-item -->

<!-- wp:list-item -->
<li>Fill in your Subject DN options as you please with Organization, Organization Unit, Country, State, Locality and Common Name.</li>
<!-- /wp:list-item -->

<!-- wp:list-item -->
<li>Set your key algorithm as desired, e.g. RSA 2048</li>
<!-- /wp:list-item --></ul>
<!-- /wp:list --></div></div>
<!-- /wp:media-text -->

<!-- wp:media-text {"mediaId":1013,"mediaLink":"https://cloudyadvice.com/?attachment_id=1013","mediaType":"image","mediaWidth":63} -->
<div class="wp-block-media-text is-stacked-on-mobile" style="grid-template-columns:63% auto"><figure class="wp-block-media-text__media"><img src="https://cloudyadvice.com/wp-content/uploads/2023/11/create-root-ca-part2-635x1024.jpg" alt="AWS Private Certificate Authority Create a Certificate Authority Wizard with CRL options." class="wp-image-1013 size-full"/></figure><div class="wp-block-media-text__content"><!-- wp:list -->
<ul><!-- wp:list-item -->
<li>Next we need to setup a Certificate Revocation List distribution point so we can have a place to publish certificates that are no longer valid.   All properly configured CAs must have a CRL location for the CA to be trusted.</li>
<!-- /wp:list-item -->

<!-- wp:list-item -->
<li>Check the boxes for <strong>Activate CRL Distribution</strong> and <strong>Create a new S3 bucket</strong>.   </li>
<!-- /wp:list-item -->

<!-- wp:list-item -->
<li>Enter a new bucket name in the S3 bucket name field.  </li>
<!-- /wp:list-item -->

<!-- wp:list-item -->
<li>You can leave the other CRL settings as default.  </li>
<!-- /wp:list-item -->

<!-- wp:list-item -->
<li>Add tags as desired</li>
<!-- /wp:list-item -->

<!-- wp:list-item -->
<li>Under CA permissions options, ensure that the check box for <strong>Authorize ACM access to renew certificates</strong> is checked.  </li>
<!-- /wp:list-item -->

<!-- wp:list-item -->
<li>Finally, check the box acknowledging the pricing for ACM and click the <strong>Create CA</strong> button.</li>
<!-- /wp:list-item --></ul>
<!-- /wp:list --></div></div>
<!-- /wp:media-text -->

<!-- wp:media-text {"mediaPosition":"right","mediaId":1014,"mediaLink":"https://cloudyadvice.com/?attachment_id=1014","mediaType":"image"} -->
<div class="wp-block-media-text has-media-on-the-right is-stacked-on-mobile"><div class="wp-block-media-text__content"><!-- wp:paragraph {"placeholder":"Content…"} -->
<p>Our Root CA is now created, but to finish activating it we need to Install a CA Certificate.  From the Actions menu in the top right corner of the Certificate Authority homepage, you should choose <strong>Install CA Certificate</strong>.  On the resulting screen accept the default 10 year validity period and SHA256 signing algorithm and click the <strong>Confirm and install</strong> button.  </p>
<!-- /wp:paragraph --></div><figure class="wp-block-media-text__media"><img src="https://cloudyadvice.com/wp-content/uploads/2023/11/install-root-certificate.jpg" alt="The AWS Private CA Install Root CA Certificate Wizard with Validity and Signature Algorithm settings." class="wp-image-1014 size-full"/></figure></div>
<!-- /wp:media-text -->

<!-- wp:paragraph -->
<p>After completing these steps, you now have a functioning Root CA that is able to start issuing private certificates.  </p>
<!-- /wp:paragraph -->

<!-- wp:heading {"level":4} -->
<h4 class="wp-block-heading" id="aioseo-important-note">Important Note on CA Hierarchies</h4>
<!-- /wp:heading -->

<!-- wp:paragraph -->
<p>From a PKI best practices perspective, you normally would never issue client certificates from your Root CA.  Instead you would setup a subordinate "Issuing CA" that trusts the Root CA and that would be used to issue all your client certificates.  However in the interest of simplifying this blog post and avoiding the additional cost of running multiple CAs, I'm going to skip that step here and move on to configuring IAM Roles Anywhere.  Just be aware of this for your production Certificate Authority deployment.</p>
<!-- /wp:paragraph -->

<!-- wp:heading {"level":3} -->
<h3 class="wp-block-heading" id="aioseo-configure-iam-roles-anywhere">Configure IAM Roles Anywhere</h3>
<!-- /wp:heading -->

<!-- wp:paragraph -->
<p>Now that we have a functioning Certificate Authority, let's get into setting up IAM Roles Anywhere.  To get started with this task, navigate to the IAM service page in your AWS Console.  Next, click on <strong>Roles</strong> on the left side navigation bar. At the bottom of the resulting page you will see a section for <strong>Roles Anywhere</strong>.  Click the <strong>Manage</strong> button to get started setting it up.  </p>
<!-- /wp:paragraph -->

<!-- wp:image {"id":1016,"sizeSlug":"large","linkDestination":"none"} -->
<figure class="wp-block-image size-large"><img src="https://cloudyadvice.com/wp-content/uploads/2023/11/manage-roles-anywhere-1024x299.jpg" alt="AWS IAM Roles console showing the Manage Roles Anywhere button." class="wp-image-1016"/></figure>
<!-- /wp:image -->

<!-- wp:heading {"level":4} -->
<h4 class="wp-block-heading" id="aioseo-establish-trust-anchor">Establish Trust Anchor</h4>
<!-- /wp:heading -->

<!-- wp:paragraph -->
<p>The Roles Anywhere page has a very nice Setup wizard that will walk you through the process.   The first thing we need to do is create a <strong>trust anchor</strong> to the Private CA we setup in the previous step.  Click the orange <strong>Create a trust anchor</strong> button to get started.</p>
<!-- /wp:paragraph -->

<!-- wp:image {"id":1017,"sizeSlug":"large","linkDestination":"none"} -->
<figure class="wp-block-image size-large"><img src="https://cloudyadvice.com/wp-content/uploads/2023/11/create-a-trust-anchor-1024x437.jpg" alt="Manage IAM Roles Anywhere console showing the Step 1: Establish Trust and highlighting the Create a trust anchor button" class="wp-image-1017"/></figure>
<!-- /wp:image -->

<!-- wp:media-text {"mediaPosition":"right","mediaId":1020,"mediaLink":"https://cloudyadvice.com/?attachment_id=1020","mediaType":"image","mediaWidth":56} -->
<div class="wp-block-media-text has-media-on-the-right is-stacked-on-mobile" style="grid-template-columns:auto 56%"><div class="wp-block-media-text__content"><!-- wp:paragraph -->
<p>You will be taken to the <strong>Create a trust anchor</strong> wizard page.</p>
<!-- /wp:paragraph -->

<!-- wp:list -->
<ul><!-- wp:list-item -->
<li>First, enter a friendly name for your trust anchor.</li>
<!-- /wp:list-item -->

<!-- wp:list-item -->
<li>Next you will choose your CA source.  Here is where you can specify an external CA to trust via uploading a certificate bundle, or you can go with <strong>AWS Private Certificate Authority</strong>, which is the default option.</li>
<!-- /wp:list-item -->

<!-- wp:list-item -->
<li>Below in the next section you will see a list of AWS Private Certificate Authorities in the account. Click the radio button next to the root CA we created in the previous step.  </li>
<!-- /wp:list-item -->

<!-- wp:list-item -->
<li>Leave notification options as default and add tags as appropriate.</li>
<!-- /wp:list-item -->

<!-- wp:list-item -->
<li>Finally, click the orange <strong>Create a trust anchor button</strong> to complete the process.</li>
<!-- /wp:list-item --></ul>
<!-- /wp:list --></div><figure class="wp-block-media-text__media"><img src="https://cloudyadvice.com/wp-content/uploads/2023/11/create-trust-anchor-wizard-1-689x1024.jpg" alt="Screenshot of the IAM Roles Anywhere Create a trust anchor wizard" class="wp-image-1020 size-full"/></figure></div>
<!-- /wp:media-text -->

<!-- wp:heading {"level":4} -->
<h4 class="wp-block-heading" id="aioseo-configure-role">Configure Role</h4>
<!-- /wp:heading -->

<!-- wp:paragraph -->
<p>After you create your trust anchor, the Setup wizard will move to the next step, <strong>Configuring roles</strong>.  If you have an existing role, you can easily configure it for Roles Anywhere by adding the required trust statements to the role.   For our demo, let's make things simple and create a new role for use with Roles Anywhere.  You can do this by clicking the <strong>Create a new role button.</strong></p>
<!-- /wp:paragraph -->

<!-- wp:image {"id":1021,"sizeSlug":"full","linkDestination":"none"} -->
<figure class="wp-block-image size-full"><img src="https://cloudyadvice.com/wp-content/uploads/2023/11/roles-anywhere-create-a-new-role.jpg" alt="Screenshot of the Manage IAM Roles Anywhere service highlighting the button to Create a new role." class="wp-image-1021"/></figure>
<!-- /wp:image -->

<!-- wp:media-text {"mediaPosition":"right","mediaId":1022,"mediaLink":"https://cloudyadvice.com/?attachment_id=1022","mediaType":"image","mediaWidth":60} -->
<div class="wp-block-media-text has-media-on-the-right is-stacked-on-mobile" style="grid-template-columns:auto 60%"><div class="wp-block-media-text__content"><!-- wp:paragraph {"placeholder":"Content…"} -->
<p>Clicking that button will take you directly to the IAM Role creation wizard.   Step 1 is <strong>Select trusted entity</strong>.   </p>
<!-- /wp:paragraph -->

<!-- wp:list -->
<ul><!-- wp:list-item -->
<li>Click the button next to <strong>AWS Service</strong>.  </li>
<!-- /wp:list-item -->

<!-- wp:list-item -->
<li>From the Use case drop down menu, select <strong>Roles Anywhere</strong>.</li>
<!-- /wp:list-item -->

<!-- wp:list-item -->
<li>Click <strong>Next</strong>. </li>
<!-- /wp:list-item --></ul>
<!-- /wp:list --></div><figure class="wp-block-media-text__media"><img src="https://cloudyadvice.com/wp-content/uploads/2023/11/create-role-select-trust.jpg" alt="Screenshot of the IAM Role creation wizard Select Trusted Entity step." class="wp-image-1022 size-full"/></figure></div>
<!-- /wp:media-text -->

<!-- wp:media-text {"mediaId":1023,"mediaLink":"https://cloudyadvice.com/?attachment_id=1023","mediaType":"image"} -->
<div class="wp-block-media-text is-stacked-on-mobile"><figure class="wp-block-media-text__media"><img src="https://cloudyadvice.com/wp-content/uploads/2023/11/assign-permissions-to-role.jpg" alt="Screenshot of the IAM Role creation wizard Add Permissions step." class="wp-image-1023 size-full"/></figure><div class="wp-block-media-text__content"><!-- wp:paragraph {"placeholder":"Content…"} -->
<p>From here we need to add permissions to the role.  This will control what API actions the external system is able to use via Roles Anywhere.   </p>
<!-- /wp:paragraph -->

<!-- wp:list -->
<ul><!-- wp:list-item -->
<li>You can attach any existing IAM policy in your account, AWS Managed policies, and even attach multiple policies.  </li>
<!-- /wp:list-item -->

<!-- wp:list-item -->
<li>For this demonstration I'm going to grant the <strong>AmazonS3ReadOnlyAccess</strong> managed policy and click <strong>Next</strong>.</li>
<!-- /wp:list-item --></ul>
<!-- /wp:list --></div></div>
<!-- /wp:media-text -->

<!-- wp:paragraph -->
<p>To complete the wizard, give your new Role a name and description, review the trust policy and permissions you just setup, assign tags and then click the orange <strong>Create Role</strong> button.</p>
<!-- /wp:paragraph -->

<!-- wp:heading {"level":4} -->
<h4 class="wp-block-heading" id="aioseo-configure-a-profile">Configure a Profile</h4>
<!-- /wp:heading -->

<!-- wp:paragraph -->
<p>After you role is created, navigate back to the <strong>Manage Roles Anywhere</strong> screen. The final setup step is to create a <strong>Profile</strong> that will associated your IAM Role for use with Roles Anywhere using a role session policy.   To complete this step, click the button that says <strong>Configure a Profile</strong>:</p>
<!-- /wp:paragraph -->

<!-- wp:image {"id":1025,"sizeSlug":"full","linkDestination":"none"} -->
<figure class="wp-block-image size-full"><img src="https://cloudyadvice.com/wp-content/uploads/2023/11/roles-anywhere-configure-profile.jpg" alt="Screenshot of the Manage IAM Roles Anywhere service highlighting the button to Configure a Profile." class="wp-image-1025"/></figure>
<!-- /wp:image -->

<!-- wp:media-text {"mediaPosition":"right","mediaId":1026,"mediaLink":"https://cloudyadvice.com/?attachment_id=1026","mediaType":"image"} -->
<div class="wp-block-media-text has-media-on-the-right is-stacked-on-mobile"><div class="wp-block-media-text__content"><!-- wp:paragraph {"placeholder":"Content…"} -->
<p>Time for yet another wizard page!  Here you will complete the following steps:</p>
<!-- /wp:paragraph -->

<!-- wp:list -->
<ul><!-- wp:list-item -->
<li>Give your Profile a name</li>
<!-- /wp:list-item -->

<!-- wp:list-item -->
<li>In the <strong>Roles</strong> section, chose the role we created in the previous step</li>
<!-- /wp:list-item -->

<!-- wp:list-item -->
<li>In the <strong>Session Policies</strong> section, you can optionally limit what permissions are granted by the role for the session created via Roles Anywhere.  For our case we will remove the default inline policy that is present, as it grants ALL access.</li>
<!-- /wp:list-item -->

<!-- wp:list-item -->
<li>Apply Tags</li>
<!-- /wp:list-item -->

<!-- wp:list-item -->
<li>Finally click the <strong>Create a profile</strong> button to finish the wizard.</li>
<!-- /wp:list-item --></ul>
<!-- /wp:list --></div><figure class="wp-block-media-text__media"><img src="https://cloudyadvice.com/wp-content/uploads/2023/11/create-profile-wizard-719x1024.jpg" alt="Screenshot of the IAM Roles Anywhere service Create a profile wizard." class="wp-image-1026 size-full"/></figure></div>
<!-- /wp:media-text -->

<!-- wp:paragraph -->
<p>At this point we have successfully completed all the setup tasks to get our IAM Roles Anywhere backend configured.   </p>
<!-- /wp:paragraph -->

<!-- wp:heading -->
<h2 class="wp-block-heading" id="aioseo-configuring-the-external-system">Configuring the External System</h2>
<!-- /wp:heading -->

<!-- wp:paragraph -->
<p>With our Roles Anywhere backend up and running, let's move on to configuring the external system for access.   The first step for this is to issue an x.509 certificate for our external system to use for authenticating to IAM Roles Anywhere.</p>
<!-- /wp:paragraph -->

<!-- wp:heading {"level":3} -->
<h3 class="wp-block-heading" id="aioseo-generate-client-certificate">Generate Client Certificate</h3>
<!-- /wp:heading -->

<!-- wp:paragraph -->
<p>In the AWS console, navigate back to <strong>Amazon Certificate Manager</strong> service.  From the service home page, click <strong>Request Certificate</strong> on the left side navigation bar (or click the big red orange button on the right):</p>
<!-- /wp:paragraph -->

<!-- wp:image {"id":1027,"sizeSlug":"large","linkDestination":"none"} -->
<figure class="wp-block-image size-large"><img src="https://cloudyadvice.com/wp-content/uploads/2023/11/request-certificate-1024x321.jpg" alt="Amazon Certificate Manager home page highlighting the button to request a new Certificate" class="wp-image-1027"/></figure>
<!-- /wp:image -->

<!-- wp:paragraph -->
<p>Under Certificate type, choose the option <strong>Request a private certificate</strong> and click <strong>Next</strong>:</p>
<!-- /wp:paragraph -->

<!-- wp:image {"id":1028,"sizeSlug":"full","linkDestination":"none"} -->
<figure class="wp-block-image size-full"><img src="https://cloudyadvice.com/wp-content/uploads/2023/11/request-a-private-cert.jpg" alt="Amazon Certificate Manager Request a new Certificate feature showing the choices for certificate type of public or private." class="wp-image-1028"/></figure>
<!-- /wp:image -->

<!-- wp:media-text {"mediaPosition":"right","mediaId":1029,"mediaLink":"https://cloudyadvice.com/?attachment_id=1029","mediaType":"image"} -->
<div class="wp-block-media-text has-media-on-the-right is-stacked-on-mobile"><div class="wp-block-media-text__content"><!-- wp:paragraph {"placeholder":"Content…"} -->
<p>You guessed it, it's wizard time!  From this wizard we will be completing the required properties for our certificate request (CSR).</p>
<!-- /wp:paragraph -->

<!-- wp:list -->
<ul><!-- wp:list-item -->
<li>In the <strong>Certificate Authority</strong> drop down menu, select the private CA we created earlier.</li>
<!-- /wp:list-item -->

<!-- wp:list-item -->
<li>Enter your domain name for the certificate in the <strong>Domain Name</strong> section.</li>
<!-- /wp:list-item -->

<!-- wp:list-item -->
<li>Choose your K<strong>ey algorithm</strong>. In this case I'm going with the default of RSA 2048.</li>
<!-- /wp:list-item -->

<!-- wp:list-item -->
<li>Add tags as desired.</li>
<!-- /wp:list-item -->

<!-- wp:list-item -->
<li>Under <strong>Certificate Renewal Permissions</strong>, click the box to acknowledge that ACM will need permissions to rewew this cert.  (you may remember we already granted this permission when we setup the CA originally).</li>
<!-- /wp:list-item -->

<!-- wp:list-item -->
<li>Click the orange <strong>Request</strong> button to complete the request.</li>
<!-- /wp:list-item --></ul>
<!-- /wp:list --></div><figure class="wp-block-media-text__media"><img src="https://cloudyadvice.com/wp-content/uploads/2023/11/private-csr-668x1024.jpg" alt="Request a private certificate wizard screen" class="wp-image-1029 size-full"/></figure></div>
<!-- /wp:media-text -->

<!-- wp:heading {"level":3} -->
<h3 class="wp-block-heading" id="aioseo-export-the-certificate">Export the Certificate</h3>
<!-- /wp:heading -->

<!-- wp:paragraph -->
<p>Your certificate will get created and after a few moments the certificate status should update from <strong>Pending validation</strong> to <strong>Issued</strong> in the Certificates list.  Once the certificate is issued, we need to download it so we can place it on our external system.  Click on the certificate in the list and from the details page click the <strong>Export</strong> button.</p>
<!-- /wp:paragraph -->

<!-- wp:image {"id":1032,"sizeSlug":"large","linkDestination":"none"} -->
<figure class="wp-block-image size-large"><img src="https://cloudyadvice.com/wp-content/uploads/2023/11/export-cert-button-1-1024x226.jpg" alt="AWS Certificate Manager Certificate Details screen with the Export button highlighted." class="wp-image-1032"/></figure>
<!-- /wp:image -->

<!-- wp:paragraph -->
<p>On the Export Certificate page you will need to add a passphrase so that the private key can be encrypted.  Next, click the checkbox to acknowledge that you will be charged for exporting this certificate:</p>
<!-- /wp:paragraph -->

<!-- wp:image {"id":1033,"sizeSlug":"full","linkDestination":"none"} -->
<figure class="wp-block-image size-full"><img src="https://cloudyadvice.com/wp-content/uploads/2023/11/export-cert-wizard.jpg" alt="AWS Certificate Manager console showing the Export a certificate request form." class="wp-image-1033"/></figure>
<!-- /wp:image -->

<!-- wp:paragraph -->
<p>After you click <strong>Generate PEM encoding</strong>, the service will return to you three items, each with Download links:</p>
<!-- /wp:paragraph -->

<!-- wp:list -->
<ul><!-- wp:list-item -->
<li>Certificate body</li>
<!-- /wp:list-item -->

<!-- wp:list-item -->
<li>Certificate chain</li>
<!-- /wp:list-item -->

<!-- wp:list-item -->
<li>Certificate private key</li>
<!-- /wp:list-item --></ul>
<!-- /wp:list -->

<!-- wp:paragraph -->
<p>Now you will need to download each of these to your local system.  You can do this by either clicking the download buttons for each item, or creating text files on your local system and copying the text into them.  Place all these files in a folder on your system.  After downloading the files, you will need to rename certificate.txt to <strong>certificate.pem</strong> and private_key.txt to <strong>private_key.pem</strong>.</p>
<!-- /wp:paragraph -->

<!-- wp:heading {"level":3} -->
<h3 class="wp-block-heading" id="aioseo-decrypt-the-private-key">Decrypt the Private Key</h3>
<!-- /wp:heading -->

<!-- wp:paragraph -->
<p>Once the files are downloaded, next we need to decrypt the private key using the passphrase we entered when we performed the export.  On a Mac or Linux system we can do that easily with openssl.  Here is  the command to use:</p>
<!-- /wp:paragraph -->

<!-- wp:code -->
<pre class="wp-block-code"><code>openssl rsa -in private_key.pem -out decrypted_private_key.pem </code></pre>
<!-- /wp:code -->

<!-- wp:paragraph -->
<p>Openssl will run and prompt you to enter the passphrase you created, and then decrypt the key to the designated output file:</p>
<!-- /wp:paragraph -->

<!-- wp:code -->
<pre class="wp-block-code"><code>Enter pass phrase for private_key.pem:
writing RSA key</code></pre>
<!-- /wp:code -->

<!-- wp:paragraph -->
<p>Success!  We've now created a new certificate for our system in Amazon Private CA, exported it our system have it ready for use with the IAM Roles Credential Helper.</p>
<!-- /wp:paragraph -->

<!-- wp:heading {"level":3} -->
<h3 class="wp-block-heading" id="aioseo-install-iam-credentials-helper">Install IAM Credentials Helper </h3>
<!-- /wp:heading -->

<!-- wp:paragraph -->
<p>As mentioned before the IAM Roles Credentials Helper is a downloadable tool maintained by AWS.   The tool is used to create a SigV4 signature with your certificate and make a call to the Roles Anywhere endpoint to obtain session credentials.   Next, the Roles Anywhere endpoint then returns the credentials to the calling process in JSON format.   You can download the latest version of the tool from the <a href="http://s a downloadable tool provided by AWS that allows you to request temporary security credentials via the CreateSession API" target="_blank" rel="noopener" title="">IAM Roles Anywhere User Guide</a>, where there are packages for Linux, Windows, and Darwin (MacOS). Download the helper and place it in the same directory where you placed your certificate and private key.  First, you'll need to make the package executable before you can use it:</p>
<!-- /wp:paragraph -->

<!-- wp:code -->
<pre class="wp-block-code"><code>chmod +x aws_signing_helper</code></pre>
<!-- /wp:code -->

<!-- wp:paragraph -->
<p>With this last step done, we've completed all the end to end setup work needed to use Roles Anywhere.   To wrap up the article, I'm going to demonstrate how to make a CreateSession API request using the credentials helper.</p>
<!-- /wp:paragraph -->

<!-- wp:heading -->
<h2 class="wp-block-heading" id="aioseo-making-the-connection">Making the Connection</h2>
<!-- /wp:heading -->

<!-- wp:paragraph -->
<p>There are three things we will need to have in order to use the AWS IAM Roles Anywhere Credentials Helper to make a CreateSession request.</p>
<!-- /wp:paragraph -->

<!-- wp:list -->
<ul><!-- wp:list-item -->
<li>Roles Anywhere Trust Anchor Amazon Resource Name (ARN)</li>
<!-- /wp:list-item -->

<!-- wp:list-item -->
<li>Profile ARN</li>
<!-- /wp:list-item -->

<!-- wp:list-item -->
<li>IAM Role ARN</li>
<!-- /wp:list-item --></ul>
<!-- /wp:list -->

<!-- wp:paragraph -->
<p>The first two items can be obtained from the IAM Roles Anywhere management page, while the IAM Role ARN can be found by examining the details of the Role in the IAM Roles page.  You will also need the filenames for your certificate and decrypted private key that we downloaded in <a href="#aioseo-export-the-certificate" title="">the previous step</a>.</p>
<!-- /wp:paragraph -->

<!-- wp:heading {"level":3} -->
<h3 class="wp-block-heading" id="aioseo-manually-request-and-set-credentials">Manually request and set credentials</h3>
<!-- /wp:heading -->

<!-- wp:paragraph -->
<p>You will combine all these items as the options for our rather long <strong>aws_signing_helper </strong>command:</p>
<!-- /wp:paragraph -->

<!-- wp:code -->
<pre class="wp-block-code"><code>./aws_signing_helper credential-process \
--trust-anchor-arn arn:aws:rolesanywhere:us-east-1:<em>111111111111</em>:trust-anchor/49d455a6-deec-4cfc-9c12-2c75217ea49a --profile-arn arn:aws:rolesanywhere:us-east-1:<em>111111111111</em>:profile/d0119c28-ecfa-4ad2-88c7-cacfd61bb268 \
--role-arn arn:aws:iam::<em>111111111111</em>:role/cloudyadvice-roles-anywhere-role \
--certificate certificate.pem --private-key decrypted_private_key.pem</code></pre>
<!-- /wp:code -->

<!-- wp:paragraph -->
<p>Note I've modified the account numbers here, you should replace with the proper values from your ARNs.  If all goes well, AWS will return you an Access Key ID, Secret Access Key, and Session token in JSON format, like so:</p>
<!-- /wp:paragraph -->

<!-- wp:code -->
<pre class="wp-block-code"><code>{"Version":1,"AccessKeyId":"ASIAVFPLXXXXXXXXXXXX","SecretAccessKey":"+ZCVCbiRHXwCOBZCi0JVv/XXXXXXXXXXXXX","SessionToken":"IQoJb3JpZ2luX2VjEC4aCXVzLWVhc3QtMSJGMEQCIFgE1/1OZjanZDOiMnVkxgKMXsoZVlQl3QJy2POXadb/AiAm7EqPHvXslugCqcaS6wCtquf/XIaMTg1YbJg3ywfXDCqIBAhmEAIaDDM1NTM2NDgyOTg2NCIM0BYAV8uBV1afYXAuKuUDMXS8VhT4SnBqg+S4yqtOj0TSZdbp/z4AKJeovB6u9g/5f2SA1tAG3hkByq/PEiuLFGN0kIgkWT66CPDNHS5iuPVXhiHIghaNqVDXzGXvWcxp5SPLbIIAQxfyQTmNiBhqg82VDaEUEutSh2kd8CdvTtlP39tEFE0q8poWbNCnDCwg1Wj50LaH7IQb3jYoTxHAnHEkTmtlqmoeYIM7UVc1RQ2Fox37nnMZVqaeY0tCyxyfmQn8tCEmaFRTxYWweCfxB7WIjptGwQGUchEBbISHnJulKU9Pv8lgct3HENWqyQcVKSWRZDvIAuFjpfq8cahcAVHrzM20KNMO3OxfZyXhBgSNalxO6c0pGoBDgmlH1o8yEVky2GSzYncSwyL++KPAzb/+FeNiT4aJeSyd3ns0Ewp/s30JbC8fuID6UuuuSfNa7VetSFBanSfIkjDhUnefjyYFyz2f+7k2X5HPYeAmT/zjwOGpNY7KcIJqZQHERhaMWn5Gy0RvjvAoVVAgyEwqwBff76TEwmxh6DMN4o/LRuOnflommJojT0BmVtfBD5Ykp53xZXPCQctF7ijN40Ud18w8ZIBF/6QUAdQe1Lp32kIH9HPq3Lg4YlvJzdsMX6BXemDWHCFLCE1BfFQXXBRRs0p8Ci8wgueaqgY6lAHD/crexcd3uBsB87czp6kyYV8iH4BMPPpxbIs3fAgjOkJMta2pROF72YKR9FRF9ixciFkBCpnACjWGSDSuwx/+elwoDJ3zlCOad7SYX0J8CBxAKKAQ564MOiYrB9wdf3N2sQd+dKJkmPSZxEN1sWnMnD/D+HrWB7A0ULsW3phER50gisns8G/KsE4q4gtz1QOrOIP6","Expiration":"2023-11-04T22:11:30Z"}% </code></pre>
<!-- /wp:code -->

<!-- wp:paragraph -->
<p>As you can see, Roles Anywhere has sent you back a send of temporary credentials in the form of an Access Key ID, a Secret Access Key, and a Session Token.   You can simply use these values returned here to set as temporary environment variables for your AWS credentials, and then issue calls to AWS using those environment variables.   For example:</p>
<!-- /wp:paragraph -->

<!-- wp:code -->
<pre class="wp-block-code"><code>export AWS_ACCESS_KEY_ID=<em>access-key-id-value</em>
export AWS_SECRET_ACCESS_KEY=<em>secret-access-key-value</em>
export AWS_SESSION_TOKEN=<em>session-token-value</em></code></pre>
<!-- /wp:code -->

<!-- wp:paragraph -->
<p>Once that is done you can issue AWS CLI commands, e.g. get a list of S3 buckets:</p>
<!-- /wp:paragraph -->

<!-- wp:code -->
<pre class="wp-block-code"><code>aws s3api list-buckets</code></pre>
<!-- /wp:code -->

<!-- wp:paragraph -->
<p>Which should return you a list of S3 buckets in JSON format.</p>
<!-- /wp:paragraph -->

<!-- wp:heading {"level":3} -->
<h3 class="wp-block-heading" id="aioseo-leverage-roles-anywhere-in-aws-cli-config">Leverage Roles Anywhere in AWS CLI Config</h3>
<!-- /wp:heading -->

<!-- wp:paragraph -->
<p>Manually requesting credentials is a great way to test, but rather laborious to do on a regular basis.  Fortunately you can leverage the <strong>aws_signing_helper</strong> as a custom credential_process for the AWS CLI.  To do this, you simply need to add it as a new profile entry in your AWS CLI credentials file to invoke it.   First, copy the certificate files and the aws_signing_helper executable to the same directory where your AWS CLI is located, typically ~./aws.   Next, you add a new profile to your ~/.aws/config file that leverages IAM Roles Anywhere.   The profile entry should look something like this:</p>
<!-- /wp:paragraph -->

<!-- wp:code -->
<pre class="wp-block-code"><code><strong>&#91;profile rolesanywhere]</strong>
credential_process = /users/cloudyadvice/.aws/aws_signing_helper credential-process --trust-anchor-arn arn:aws:rolesanywhere:us-east-1:<em>111111111111</em>:trust-anchor/49d455a6-deec-4cfc-9c12-2c75217ea49a --profile-arn arn:aws:rolesanywhere:us-east-1:<em>111111111111</em>:profile/d0119c28-ecfa-4ad2-88c7-cacfd61bb268 \
--role-arn arn:aws:iam::<em>111111111111</em>:role/cloudyadvice-roles-anywhere-role \
--certificate certificate.pem --private-key decrypted_private_key.pem</code></pre>
<!-- /wp:code -->

<!-- wp:paragraph -->
<p>Obviously, you would need to replace the dummy values shown here with the proper values from your own environment.  Once you've added this new profile to your ~/.aws/config file, you can call it for use with any AWS CLI command with the --profile flag, for example:</p>
<!-- /wp:paragraph -->

<!-- wp:code -->
<pre class="wp-block-code"><code>aws s3 ls --profile rolesanywhere</code></pre>
<!-- /wp:code -->

<!-- wp:paragraph -->
<p>Now AWS CLI will leverage Roles Anywhere to mint dynamic temporary credentials when you execute commands using this profile switch.  Totally awesome!!</p>
<!-- /wp:paragraph -->

<!-- wp:heading -->
<h2 class="wp-block-heading" id="aioseo-closing-thoughts">Closing Thoughts</h2>
<!-- /wp:heading -->

<!-- wp:paragraph -->
<p>I was so excited when IAM Roles Anywhere was announced because it solves a real world problem I often have to deal with in my day job.  As a result I was glad to finally got around to testing it out and writing up this blog post. </p>
<!-- /wp:paragraph -->

<!-- wp:paragraph -->
<p>Obviously, this was a fairly long blog post covering a pretty complicated setup. AWS IAM by itself is a very complicated service.  Then when you add public key infrastructure into the mix, things get even more complicated.  To help with this complexity, I've done my best here to walk through the steps in an easy to follow fashion so you can start experimenting with this powerful service.</p>
<!-- /wp:paragraph -->

<!-- wp:paragraph -->
<p>I hope that you will see the benefit of this great service and use it to make your own AWS environments more secure.   Are you already using IAM Roles Anywhere in your environment?  Share your experiences and thoughts in the comments!</p>
<!-- /wp:paragraph -->

<!-- wp:heading -->
<h2 class="wp-block-heading" id="aioseo-references">References</h2>
<!-- /wp:heading -->

<!-- wp:paragraph -->
<p><a href="https://aws.amazon.com/blogs/security/extend-aws-iam-roles-to-workloads-outside-of-aws-with-iam-roles-anywhere/" target="_blank" rel="noopener" title="">AWS Security Blog - IAM Roles Anywhere Launch Post</a></p>
<!-- /wp:paragraph -->

<!-- wp:paragraph -->
<p><a href="https://aws.amazon.com/blogs/security/iam-roles-anywhere-with-an-external-certificate-authority/">AWS Security Blog - IAM Roles Anywhere with an external certificate authority</a></p>
<!-- /wp:paragraph -->

<!-- wp:paragraph -->
<p><a href="https://aws.amazon.com/blogs/security/enable-external-pipeline-deployments-to-aws-cloud-by-using-iam-roles-anywhere/" target="_blank" rel="noopener" title="">AWS Security Blog - Enable external pipeline deployments to AWS Cloud by using IAM Roles Anywhere</a></p>
<!-- /wp:paragraph -->

<!-- wp:paragraph -->
<p><a href="https://docs.aws.amazon.com/rolesanywhere/latest/userguide/introduction.html" target="_blank" rel="noopener" title="">AWS IAM Roles Anywhere User Guide</a></p>
<!-- /wp:paragraph -->

<!-- wp:paragraph -->
<p><a href="https://youtu.be/gOXILJcOemo?si=uuEwrtTJbMlPI3Xo" target="_blank" rel="noopener" title="">YouTube - AWS re:Inforce 2023 Managing hybrid workloads with IAM Roles Anywhere, featuring Hert</a>z</p>
<!-- /wp:paragraph -->

<!-- wp:paragraph -->
<p><a href="https://youtu.be/n4UZZsTIlVA?si=UnvO6xLFzJvckjru" target="_blank" rel="noopener" title="">Hacker Loi YouTube - AWS IAM Roles Anywhere Full Tutorial</a></p>
<!-- /wp:paragraph -->

<!-- wp:paragraph -->
<p><a href="https://github.com/aws/rolesanywhere-credential-helper" target="_blank" rel="noopener" title="">GitHub AWS repo - roles anywhere credential helper</a></p>
<!-- /wp:paragraph -->