|
@@ -1,19 +1,19 @@
|
|
|
# AWS Notes.md
|
|
|
|
|
|
-For the latest AWS account information see https://github.xdr.accenturefederalcyber.com/mdr-engineering/msoc-infrastructure/wiki/cloud-accounts
|
|
|
+For the latest AWS account information see [Cloud Accounts Wiki](https://github.xdr.accenturefederalcyber.com/mdr-engineering/msoc-infrastructure/wiki/cloud-accounts)
|
|
|
|
|
|
|
|
|
### LEGACY AWS ACCOUNTS
|
|
|
-Root Account Alias (in AWS): defpoint-mdr-root
|
|
|
-Root Account Alias (for terraform/in `~/.aws/{config,credentials}`): mdr-root
|
|
|
-Root AWS Account ID: 350838957895
|
|
|
-GovCloud Root Account: 701290387780
|
|
|
+Root Account Alias (in AWS): defpoint-mdr-root
|
|
|
+Root Account Alias (for terraform/in `~/.aws/{config,credentials}`): mdr-root
|
|
|
+Root AWS Account ID: 350838957895
|
|
|
+GovCloud Root Account: 701290387780
|
|
|
|
|
|
-Test Account ID: 527700175026
|
|
|
-Prod Account ID: 477548533976
|
|
|
-Org Account ID: 228011623757
|
|
|
+Test Account ID: 527700175026
|
|
|
+Prod Account ID: 477548533976
|
|
|
+Org Account ID: 228011623757
|
|
|
|
|
|
-assumeRole to the test and prod accounts
|
|
|
+`assumeRole` to the test and prod accounts
|
|
|
|
|
|
---
|
|
|
terraform has been setup to handle the cis checks for AWS. they are found in terraform/00-cis-hardening.
|
|
@@ -63,25 +63,27 @@ systemctl start amazon-ssm-agent
|
|
|
|
|
|
## AWS User Password Distribution ( legecy )
|
|
|
|
|
|
+```
|
|
|
https://gpgtools.org/ download and install
|
|
|
use gpg keychain to generate pub/private keys
|
|
|
something something terraform
|
|
|
echo "wcFMA2sXDKYLpzaU<redacted>bf6clQ043oDkHIrcWK509UIy5GUpEqBV/WLmuCMHkXUgnxy12HY8qBErF58vB7/VXs5pCKp4SDYWEtK73fKmYZ5wJDW6j6OHkpYI4USZXjVYb+Utt56Qprk4KiT6VlFNNPo00r2YDABDdtxPJS3N9REzHqp+7oR2SQkiyEhcF3ZwILk2fH4mc1VQUiFu68RCqbt+QfmDt3OHIRZVPvrS4AHkCbj2fdgkbAaRMJ/21TBn8OE8WuDR4NHh5w/gWeK5m6754DzkjVLxDpsvPG2UR9ErwANEo+BI4upil2vgT+S63PIVsAmTew/7QpPavttP4rUBM47h5cMA"|base64 -D | gpg -d
|
|
|
-
|
|
|
+```
|
|
|
|
|
|
-Export in one line and base64
|
|
|
+```
|
|
|
+#Export in one line and base64
|
|
|
gpg --export | base64
|
|
|
-
|
|
|
+```
|
|
|
## saml2aws
|
|
|
2020-05-07
|
|
|
|
|
|
-on OSX, install saml2aws via:
|
|
|
+on OSX, install `saml2aws` via:
|
|
|
```
|
|
|
# 2021-04-21 - you should not need to install the tap any more
|
|
|
#brew tap versent/homebrew-taps
|
|
|
brew install saml2aws
|
|
|
```
|
|
|
-otherwise follow instructions on [github](https://github.com/Versent/saml2aws).
|
|
|
+otherwise follow instructions on [Github](https://github.com/Versent/saml2aws).
|
|
|
|
|
|
Create `~/.saml2aws` with the following:
|
|
|
```
|
|
@@ -148,17 +150,15 @@ And use the profile via:
|
|
|
aws --profile govcloud ec2 describe-instances
|
|
|
```
|
|
|
|
|
|
-Authentication not working? saml2aws uses the MAC keychain to store your password. When you update your password you need to update the password in keychain as well. Or resetup saml2aws.
|
|
|
+Authentication not working? `saml2aws` uses the MAC keychain to store your password. When you update your password you need to update the password in keychain as well. Or resetup saml2aws.
|
|
|
|
|
|
## AssumeRole Extension and ~/.aws/config
|
|
|
08/03/2020
|
|
|
|
|
|
-Install the plugin for chrome/firefox:
|
|
|
-Firefox
|
|
|
-https://addons.mozilla.org/en-US/firefox/addon/aws-extend-switch-roles3/#&gid=1&pid=3
|
|
|
+Install the plugin for chrome/firefox:
|
|
|
+Firefox [aws-extend-switch-roles](https://addons.mozilla.org/en-US/firefox/addon/aws-extend-switch-roles3/#&gid=1&pid=3)
|
|
|
|
|
|
-Chrome
|
|
|
-https://chrome.google.com/webstore/detail/aws-extend-switch-roles/jpmkfafbacpgapdghgdpembnojdlgkdl/related?hl=en
|
|
|
+Chrome [aws-extend-switch-roles](https://chrome.google.com/webstore/detail/aws-extend-switch-roles/jpmkfafbacpgapdghgdpembnojdlgkdl/related?hl=en)
|
|
|
|
|
|
Copy this into `~/.aws/credentials`
|
|
|
```
|
|
@@ -189,8 +189,8 @@ fields @timestamp, @message
|
|
|
|
|
|
relevant links
|
|
|
|
|
|
-* https://programminghistorian.org/en/lessons/json-and-jq
|
|
|
-* https://gist.github.com/lukeplausin/b64c10f8b524bb310e0083756c42caf6
|
|
|
+* [Reshaping JSON with jq](https://programminghistorian.org/en/lessons/json-and-jq)
|
|
|
+* [AWS, JQ and bash command cheat sheet](https://gist.github.com/lukeplausin/b64c10f8b524bb310e0083756c42caf6)
|
|
|
|
|
|
#### dump a list of ec2 instances and some of their relevant fields into a CSV
|
|
|
|