> For the complete documentation index, see [llms.txt](https://jotter.gitbook.io/red-team/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://jotter.gitbook.io/red-team/cloud/aws/initial-access-and-authentication.md).

# Initial Access and Authentication

### Authentication

Authentication via CLI is handed through access tokens - **if you have a user/pass, use cloud shell to get keys.**

Note that permanent IAM role keys (users) start with `AKIA` - managed identity roles begin with `ASIA` and require session tokens.

```
# Configure tokens
aws configure

# From cloud shell for AWS tokens
TOKEN=$(curl -X PUT localhost:1338/latest/api/token -H "X-aws-ec2-metadata-token-ttl-seconds: 60")
curl localhost:1338/latest/meta-data/container/security-credentials -H "X-aws-ec2-metadata-token: $TOKEN"
```

### Account ID

An `AWS_ACCESS_KEY` without associated secret is enough to discover the account ID for use in password spraying attacks.

```
aws sts get-access-key-info --access-key-id [KEY]
```