STS Credentials Basics

1) Create a user (CloudShell)

Save output to use on our attack machine

aws iam create-user --user-name USERNAME

2) Add them to a group, granting them some permissions if the group has any

aws iam add-user-to-group --user-name USERNAME --group-name GROUPNAME

3) Verify

aws iam list-groups-for-user --user-name USERNAME

4) Create an access key for our user

aws iam create-access-key --user-name USERNAME

5) Add the keys as environment variables (Attack machine)

export AWS_SECRET_ACCESS_KEY=40_CHAR_ACCESS_KEY
export AWS_ACCESS_KEY_ID=AKIA_ACCESS_KEY_ID

6) Set these environment variables in AWS CLI

aws configure

7) Validate

aws sts get-caller-identity

8) Assume role you want

Take the output and set the as AWS CLI environment variables

aws sts assume-role --role-arn arn:aws:iam::ACCOUNT_ID:role/ROLENAME --role-session-name SESSIONNAME

9) Set output

export AWS_SECRET_ACCESS_KEY=40_CHAR_ACCESS_KEY
export AWS_ACCESS_KEY_ID=ASIA_TEMP_ACCESS_KEY_ID
export AWS_SESSION_TOKEN=BIG_ASS_SESSION_TOKEN_PRINTED_FROM_PREVIOUS_COMMAND

10) Validate

aws sts get-caller-identity