Obtenha um token de sessão que exija um token de MFA com o AWS STS usando um AWS SDK - AWS Identity and Access Management

Obtenha um token de sessão que exija um token de MFA com o AWS STS usando um AWS SDK

O código de exemplo a seguir mostra como:

  • Criar um perfil do IAM que conceda permissão para listar os buckets do Amazon S3.

  • Criar um usuário do IAM que tenha permissão para assumir o perfil somente quando as credenciais de MFA forem fornecidas.

  • Registrar um dispositivo MFA para o usuário.

  • Forneça credenciais de MFA para obter um token de sessão e use credenciais temporárias para listar buckets do S3.

Python
SDK para Python (Boto3).
dica

Para saber mais sobre como configurar e executar esse exemplo, consulte o GitHub.

Crie um usuário do IAM, registre um dispositivo de MFA e crie um perfil que conceda permissão para deixar o usuário listar os buckets do S3 somente quando credenciais de MFA forem usadas.

def setup(iam_resource): """ Creates a new user with no permissions. Creates a new virtual multi-factor authentication (MFA) device. Displays the QR code to seed the device. Asks for two codes from the MFA device. Registers the MFA device for the user. Creates an access key pair for the user. Creates an inline policy for the user that lets the user list Amazon S3 buckets, but only when MFA credentials are used. Any MFA device that can scan a QR code will work with this demonstration. Common choices are mobile apps like LastPass Authenticator, Microsoft Authenticator, or Google Authenticator. :param iam_resource: A Boto3 AWS Identity and Access Management (IAM) resource that has permissions to create users, MFA devices, and policies in the account. :return: The newly created user, user key, and virtual MFA device. """ user = iam_resource.create_user(UserName=unique_name('user')) print(f"Created user {user.name}.") virtual_mfa_device = iam_resource.create_virtual_mfa_device( VirtualMFADeviceName=unique_name('mfa')) print(f"Created virtual MFA device {virtual_mfa_device.serial_number}") print(f"Showing the QR code for the device. Scan this in the MFA app of your " f"choice.") with open('qr.png', 'wb') as qr_file: qr_file.write(virtual_mfa_device.qr_code_png) webbrowser.open(qr_file.name) print(f"Enter two consecutive code from your MFA device.") mfa_code_1 = input("Enter the first code: ") mfa_code_2 = input("Enter the second code: ") user.enable_mfa( SerialNumber=virtual_mfa_device.serial_number, AuthenticationCode1=mfa_code_1, AuthenticationCode2=mfa_code_2) os.remove(qr_file.name) print(f"MFA device is registered with the user.") user_key = user.create_access_key_pair() print(f"Created access key pair for user.") print(f"Wait for user to be ready.", end='') progress_bar(10) user.create_policy( PolicyName=unique_name('user-policy'), PolicyDocument=json.dumps({ 'Version': '2012-10-17', 'Statement': [ { 'Effect': 'Allow', 'Action': 's3:ListAllMyBuckets', 'Resource': 'arn:aws:s3:::*', 'Condition': {'Bool': {'aws:MultiFactorAuthPresent': True}} } ] }) ) print(f"Created an inline policy for {user.name} that lets the user list buckets, " f"but only when MFA credentials are present.") print("Give AWS time to propagate these new resources and connections.", end='') progress_bar(10) return user, user_key, virtual_mfa_device

Obtenha credenciais de sessão temporárias passando um token de MFA e use-as para listar buckets do S3 para a conta.

def list_buckets_with_session_token_with_mfa(mfa_serial_number, mfa_totp, sts_client): """ Gets a session token with MFA credentials and uses the temporary session credentials to list Amazon S3 buckets. Requires an MFA device serial number and token. :param mfa_serial_number: The serial number of the MFA device. For a virtual MFA device, this is an Amazon Resource Name (ARN). :param mfa_totp: A time-based, one-time password issued by the MFA device. :param sts_client: A Boto3 STS instance that has permission to assume the role. """ if mfa_serial_number is not None: response = sts_client.get_session_token( SerialNumber=mfa_serial_number, TokenCode=mfa_totp) else: response = sts_client.get_session_token() temp_credentials = response['Credentials'] s3_resource = boto3.resource( 's3', aws_access_key_id=temp_credentials['AccessKeyId'], aws_secret_access_key=temp_credentials['SecretAccessKey'], aws_session_token=temp_credentials['SessionToken']) print(f"Buckets for the account:") for bucket in s3_resource.buckets.all(): print(bucket.name)

Destrua os recursos criados para a demonstração.

def teardown(user, virtual_mfa_device): """ Removes all resources created during setup. :param user: The demo user. :param role: The demo MFA device. """ for user_pol in user.policies.all(): user_pol.delete() print("Deleted inline user policy.") for key in user.access_keys.all(): key.delete() print("Deleted user's access key.") for mfa in user.mfa_devices.all(): mfa.disassociate() virtual_mfa_device.delete() user.delete() print(f"Deleted {user.name}.")

Execute esse cenário usando a funções definidas anteriormente.

def usage_demo(): """Drives the demonstration.""" print('-'*88) print(f"Welcome to the AWS Security Token Service assume role demo, " f"starring multi-factor authentication (MFA)!") print('-'*88) iam_resource = boto3.resource('iam') user, user_key, virtual_mfa_device = setup(iam_resource) try: sts_client = boto3.client( 'sts', aws_access_key_id=user_key.id, aws_secret_access_key=user_key.secret) try: print("Listing buckets without specifying MFA credentials.") list_buckets_with_session_token_with_mfa(None, None, sts_client) except ClientError as error: if error.response['Error']['Code'] == 'AccessDenied': print("Got expected AccessDenied error.") mfa_totp = input('Enter the code from your registered MFA device: ') list_buckets_with_session_token_with_mfa( virtual_mfa_device.serial_number, mfa_totp, sts_client) finally: teardown(user, virtual_mfa_device) print("Thanks for watching!")
  • Para obter detalhes da API, consulte GetSessionToken na Referência da API do AWS SDK for Python (Boto3).

Para obter uma lista completa dos Guias do desenvolvedor do SDK da AWS e exemplos de código, consulte Usar o IAM com um AWS SDK. Este tópico também inclui informações sobre como começar e detalhes sobre versões anteriores do SDK.