Initial Access and Authentication

Authentication

Authentication via CLI is handed through access tokens - if you have a user/pass, use cloud shell to get keys.

Note that permanent IAM role keys (users) start with AKIA - managed identity roles begin with ASIA and require session tokens.

# Configure tokens
aws configure

# From cloud shell for AWS tokens
TOKEN=$(curl -X PUT localhost:1338/latest/api/token -H "X-aws-ec2-metadata-token-ttl-seconds: 60")
curl localhost:1338/latest/meta-data/container/security-credentials -H "X-aws-ec2-metadata-token: $TOKEN"

Account ID

An AWS_ACCESS_KEY without associated secret is enough to discover the account ID for use in password spraying attacks.

aws sts get-access-key-info --access-key-id [KEY]