awscli

出自Gea-Suan Lin's Wiki
跳至導覽 跳至搜尋

awscliAWS官方提供的Command Line Interface(CLI)軟體。

安裝

可以透過pipx安裝,避免影響到目前環境內的套件:

pipx install awscli

常用指令

IAM

開管理員帳號(這邊是使用AWS內已經有的AdministratorAccess):

aws iam create-user --user-name ${MY_AWS_USERNAME}
aws iam attach-user-policy --policy-arn arn:aws:iam::aws:policy/AdministratorAccess --user-name ${MY_AWS_USERNAME}

生出access key,一個帳號最多兩把。其中的AccessKeyIdSecretAccessKey就是需要的設定,要注意SecretAccessKey之後不會再出現:

aws iam create-access-key --user-name ${MY_AWS_USERNAME}

超過兩把再呼叫會出現錯誤訊息:

An error occurred (LimitExceeded) when calling the CreateAccessKey operation: Cannot exceed quota for AccessKeysPerUser: 2

列出這個帳號所有的access key(只會有AccessKeyId,不會有SecretAccessKey):

aws iam list-access-keys --user-name ${MY_AWS_USERNAME}

S3

  • 建立一個S3 bucket,
  • 建立對應的使用者(IAM),
  • 掛上完整的權限,
  • 產生對應的key:
BUCKET_NAME=gslin-test; aws s3 mb s3://${BUCKET_NAME}; aws iam create-user --user-name s3.${BUCKET_NAME}.full; aws iam put-user-policy --user-name s3.${BUCKET_NAME}.full --policy-name Policy-s3-${BUCKET_NAME}-full --policy-document '{"Version":"2012-10-17","Statement":[{"Action":["s3:*"],"Resource":"arn:aws:s3:::'${BUCKET_NAME}'/*","Effect":"Allow"}]}'; aws iam create-access-key --user-name s3.${BUCKET_NAME}.full

如果是只能讀取的話,這邊列出比較常見的操作("s3:GetObject","s3:HeadObject","s3:ListObjects","s3:ListObjectsV2"這段):

BUCKET_NAME=gslin-test; aws s3 mb s3://${BUCKET_NAME}; aws iam create-user --user-name s3.${BUCKET_NAME}.readonly; aws iam put-user-policy --user-name s3.${BUCKET_NAME}.readonly --policy-name Policy-s3-${BUCKET_NAME}-readonly --policy-document '{"Version":"2012-10-17","Statement":[{"Action":["s3:GetObject","s3:HeadObject","s3:ListObjects","s3:ListObjectsV2"],"Resource":"arn:aws:s3:::'${BUCKET_NAME}'/*","Effect":"Allow"}]}'; aws iam create-access-key --user-name s3.${BUCKET_NAME}.readonly

外部連結