3.2.8.7. S3 리소스 액세스

프로세스

1. 다음은 S3 리소스에 액세스하기 위해 STS를 사용하여 임시 액세스 및 시크릿 키를 가져오는 경우의 예입니다.

   [roo@host01 ~]# cat test-assume-role.sh
   #!/bin/bash
   export AWS_CA_BUNDLE="/etc/pki/ca-trust/source/anchors/cert.pem"
   unset AWS_ACCESS_KEY_ID
   unset AWS_SECRET_ACCESS_KEY
   unset AWS_SESSION_TOKEN
   KC_ACCESS_TOKEN=$(curl -k -q -L -X POST
   "https://keycloak-sso.apps.ocp.example.com/auth/realms/ceph/protocol/openid-connect/
   token" \
   -H 'Content-Type: application/x-www-form-urlencoded' \
   --data-urlencode 'client_id=ceph' \
   --data-urlencode 'grant_type=password' \
   --data-urlencode 'client_secret=XXXXXXXXXXXXXXXXXXXXXXX' \
   --data-urlencode 'scope=openid' \
   --data-urlencode "<varname>SSOUSERNAME</varname>" \
   --data-urlencode "<varname>SSOPASSWORD</varname>" | jq -r .access_token)
   echo ${KC_ACCESS_TOKEN}
   IDM_ASSUME_ROLE_CREDS=$(aws sts assume-role-with-web-identity --role-arn
   "arn:aws:iam:::role/$3" --role-session-name testbr
   --endpoint=https://cephproxy1.example.com:8443
   --web-identity-token="$KC_ACCESS_TOKEN")
   echo "aws sts assume-role-with-web-identity --role-arn "arn:aws:iam:::role/$3"
   --role-session-name testb --endpoint=https://cephproxy1.example.com:8443
   --web-identity-token="$KC_ACCESS_TOKEN""
   echo $IDM_ASSUME_ROLE_CREDS
   export AWS_ACCESS_KEY_ID=$(echo $IDM_ASSUME_ROLE_CREDS | jq -r
   .Credentials.AccessKeyId)
   export AWS_SECRET_ACCESS_KEY=$(echo $IDM_ASSUME_ROLE_CREDS | jq -r
   .Credentials.SecretAccessKey)
   export AWS_SESSION_TOKEN=$(echo $IDM_ASSUME_ROLE_CREDS | jq -r
   .Credentials.SessionToken)

2. 스크립트를 실행합니다.

   예

   [root@host01 ~]# source ./test-assume-role.sh s3admin passw0rd rgwadmins
   [root@host01 ~]# aws s3 mb s3://testbucket
   [root@host01 ~]# aws s3 ls