getroot

gistfile1.txt

import boto3
      
# proceed to create clients / resources from the session 
# for example, an s3 client:
 
# client = session.client('s3')    
# 
master_roles = [
    # "arn:aws:iam::836589089214:role/JamRole-EC2Admin",
    # "arn:aws:iam::836589089214:role/JamRole-S3Access",
    "arn:aws:iam::836589089214:role/JamRole-ServerlessAdmin"
]  

try_roles = [
    "arn:aws:iam::836589089214:role/JamRole-ServerlessAdmin",
    "arn:aws:iam::836589089214:role/JamRole-EmergencyAdministration",
    "arn:aws:iam::836589089214:role/JamRole-SecurityReadOnly"
    ]

sts_client = boto3.client("sts")

for master_role in master_roles:
    print(f"trying: {master_role}")
    master_assume = sts_client.assume_role(RoleArn=master_role, RoleSessionName="test_assume")
    master_credentials = master_assume.get("Credentials")

    master_sts_client = boto3.client("sts",
            region_name="eu-central-1",
            aws_access_key_id=master_credentials["AccessKeyId"],
            aws_secret_access_key=master_credentials["SecretAccessKey"],
            aws_session_token=master_credentials["SessionToken"],)

    try:
        lambda_cli = boto3.client(
                "lambda",
                region_name="eu-central-1",
                aws_access_key_id=master_credentials["AccessKeyId"],
                aws_secret_access_key=master_credentials["SecretAccessKey"],
                aws_session_token=master_credentials["SessionToken"],
            )
        response = lambda_cli.invoke(
            FunctionName="getSecret",
            InvocationType="RequestResponse",
            #Payload=json.dumps(payload),
        )

        print(response.get("Payload").read())
    except:
        print("fail")
    continue
    for try_role in try_roles:
        print(f"assuming {try_role}")
        try: 
            assumed_role = master_sts_client.assume_role(
                region_name="us-east-1",
                RoleArn=try_role, 
                RoleSessionName="test_assume2")
        except:
            print("Can't assume role")
            continue
        assumed_credentials = assumed_role.get("Credentials")
        try:
            lambda_cli = boto3.client(
                    "lambda",
                    region_name="us-east-1",
                    aws_access_key_id=assumed_credentials["AccessKeyId"],
                    aws_secret_access_key=assumed_credentials["SecretAccessKey"],
                    aws_session_token=assumed_credentials["SessionToken"],
                )
            response = lambda_cli.invoke(
                FunctionName="getSecret",
                InvocationType="RequestResponse",
                #Payload=json.dumps(payload),
            )

            print(response)
        except:
            print("fail")