BootStrapFromCloudShellNoConsoleAccess.sh

# Creating script for bootstrapping of secrets needed for DAS to work
#!/bin/bash

# =============================================================================
# SECURITY NOTICE (sample / workshop setup script - NON-PRODUCTION)
# -----------------------------------------------------------------------------
# For convenience in a disposable workshop account, this CloudShell helper
# creates an IAM user with the AWS-managed AdministratorAccess policy and
# generates long-lived access keys (stored in Secrets Manager for the
# no-console-access flow). This is acceptable ONLY for a personally-owned
# sandbox account used to run this sample. For any real/shared/production
# account you MUST grant least-privilege permissions instead of
# AdministratorAccess and prefer short-lived credentials (IAM Identity Center /
# STS) over long-lived access keys. Delete the IAM user and its access key as
# soon as you finish the walkthrough.
# =============================================================================

username=$1
# Variable name to check
region=$AWS_REGION
# Default value if the variable is not set
default_value="us-east-1"

# Check if the variable is set
if [ -n "$region" ]; then
  # Variable exists, use its value
  value=$region
  echo "Variable \$AWS_REGION exists and its value is: $value"
else
  # Variable does not exist, set it to the default value
  region=$default_value
  echo "Variable \$AWS_REGION does not exist. Setting it to default value: $default_value"
fi

echo "Creating user $username"
aws iam create-user --user-name $username --output json --no-cli-pager
aws iam attach-user-policy --user-name $username --policy-arn arn:aws:iam::aws:policy/AdministratorAccess --output json --no-cli-pager

# improvement: check for access keys and loop thru it to delete them

echo "Creating access key..."
ACCESSKEY=$(aws iam create-access-key --user-name $username --output json --no-cli-pager)
ACCESSKEYID=$(echo $ACCESSKEY | jq -r '.AccessKey.AccessKeyId')
SECRETKEYID=$(echo $ACCESSKEY | jq -r '.AccessKey.SecretAccessKey')

echo "Checking if secrets exist..."
aws secretsmanager delete-secret --secret-id aws-access-key-id --force-delete-without-recovery --region $region --no-cli-pager
aws secretsmanager delete-secret --secret-id aws-secret-access-key --force-delete-without-recovery --region $region --no-cli-pager

sleep 10

echo "Creating secrets..."
aws secretsmanager create-secret --name aws-access-key-id --secret-string {\"aws-access-key-id\":\"$ACCESSKEYID\"} --region $region --no-cli-pager
aws secretsmanager create-secret --name aws-secret-access-key --secret-string {\"aws-secret-access-key\":\"$SECRETKEYID\"} --region $region --no-cli-pager

echo "Configuring profile..."
aws configure set aws_access_key_id $ACCESSKEYID --profile $username
aws configure set aws_secret_access_key $SECRETKEYID --profile $username
aws configure set region $AWS_REGION --profile $username

echo "Your access Key:"
echo $ACCESSKEYID
echo "Your secret Key:"
echo $SECRETKEYID
echo "Your region:"
echo $region