aws-access-token.md (6230B)
1 --- 2 title: "AWS - Access Token & Secrets" 3 section: "Cloud" 4 sectionSlug: "cloud" 5 sourcePath: "docs/cloud/aws/aws-access-token.md" 6 sourceUrl: "https://github.com/swisskyrepo/InternalAllTheThings/blob/203bb0c0b290/docs/cloud/aws/aws-access-token.md" 7 sha: "203bb0c0b290" 8 isIndex: false 9 --- 10 11 # AWS - Access Token & Secrets 12 13 ## URL Services 14 15 | Service | URL | 16 | ------------ | ----------------------------------------------------------------------------------- | 17 | s3 | `https://{user_provided}.s3.amazonaws.com` | 18 | cloudfront | `https://{random_id}.cloudfront.net` | 19 | ec2 | `https://ec2-{ip-seperated}.compute-1.amazonaws.com` | 20 | es | `https://{user_provided}-{random_id}.{region}.es.amazonaws.com` | 21 | elb | `http://{user_provided}-{random_id}.{region}.elb.amazonaws.com:80/443` | 22 | elbv2 | `https://{user_provided}-{random_id}.{region}.elb.amazonaws.com` | 23 | rds | `mysql://{user_provided}.{random_id}.{region}.rds.amazonaws.com:3306` | 24 | rds | `postgres://{user_provided}.{random_id}.{region}.rds.amazonaws.com:5432` | 25 | route 53 | `{user_provided}` | 26 | execute-api | `https://{random_id}.execute-api.{region}.amazonaws.com/{user_provided}` | 27 | cloudsearch | `https://doc-{user_provided}-{random_id}.{region}.cloudsearch.amazonaws.com` | 28 | transfer | `sftp://s-{random_id}.server.transfer.{region}.amazonaws.com` | 29 | iot | `mqtt://{random_id}.iot.{region}.amazonaws.com:8883` | 30 | iot | `https://{random_id}.iot.{region}.amazonaws.com:8443` | 31 | iot | `https://{random_id}.iot.{region}.amazonaws.com:443` | 32 | mq | `https://b-{random_id}-{1,2}.mq.{region}.amazonaws.com:8162` | 33 | mq | `ssl://b-{random_id}-{1,2}.mq.{region}.amazonaws.com:61617` | 34 | kafka | `b-{1,2,3,4}.{user_provided}.{random_id}.c{1,2}.kafka.{region}.amazonaws.com` | 35 | kafka | `{user_provided}.{random_id}.c{1,2}.kafka.useast-1.amazonaws.com` | 36 | cloud9 | `https://{random_id}.vfs.cloud9.{region}.amazonaws.com` | 37 | mediastore | `https://{random_id}.data.mediastore.{region}.amazonaws.com` | 38 | kinesisvideo | `https://{random_id}.kinesisvideo.{region}.amazonaws.com` | 39 | mediaconvert | `https://{random_id}.mediaconvert.{region}.amazonaws.com` | 40 | mediapackage | `https://{random_id}.mediapackage.{region}.amazonaws.com/in/v1/{random_id}/channel` | 41 42 ## Access Key ID & Secret 43 44 IAM uses the following prefixes to indicate what type of resource each unique ID applies to. The first four characters are the prefix that depends on the type of the key. 45 46 | Prefix | Resource type | 47 | ------ | ------------------------------ | 48 | ABIA | AWS STS service bearer token | 49 | ACCA | Context-specific credential | 50 | AGPA | User group | 51 | AIDA | IAM user | 52 | AIPA | Amazon EC2 instance profile | 53 | AKIA | Access key | 54 | ANPA | Managed policy | 55 | ANVA | Version in a managed policy | 56 | APKA | Public key | 57 | AROA | Role | 58 | ASCA | Certificate | 59 | ASIA | Temporary (AWS STS) access key | 60 61 The rest of the string is Base32 encoded and can be used to recover the account id. 62 63 ```py 64 import base64 65 import binascii 66 67 def AWSAccount_from_AWSKeyID(AWSKeyID): 68 69 trimmed_AWSKeyID = AWSKeyID[4:] #remove KeyID prefix 70 x = base64.b32decode(trimmed_AWSKeyID) #base32 decode 71 y = x[0:6] 72 73 z = int.from_bytes(y, byteorder='big', signed=False) 74 mask = int.from_bytes(binascii.unhexlify(b'7fffffffff80'), byteorder='big', signed=False) 75 76 e = (z & mask)>>7 77 return (e) 78 79 80 print ("account id:" + "{:012d}".format(AWSAccount_from_AWSKeyID("ASIAQNZGKIQY56JQ7WML"))) 81 ``` 82 83 ## Regions 84 85 * US Standard - [s3.amazonaws.com](http://s3.amazonaws.com) 86 * Ireland - [s3-eu-west-1.amazonaws.com](http://s3-eu-west-1.amazonaws.com) 87 * Northern California - [s3-us-west-1.amazonaws.com](http://s3-us-west-1.amazonaws.com) 88 * Singapore - [s3-ap-southeast-1.amazonaws.com](http://s3-ap-southeast-1.amazonaws.com) 89 * Tokyo - [s3-ap-northeast-1.amazonaws.com](http://s3-ap-northeast-1.amazonaws.com) 90 91 ## Gaining AWS Console Access via API Keys 92 93 A utility to convert your AWS CLI credentials into AWS console access. 94 95 * Using [NetSPI/aws_consoler](https://github.com/NetSPI/aws_consoler) 96 97 ```powershell 98 $> aws_consoler -v -a AKIA[REDACTED] -s [REDACTED] 99 2020-03-13 19:44:57,800 [aws_consoler.cli] INFO: Validating arguments... 100 2020-03-13 19:44:57,801 [aws_consoler.cli] INFO: Calling logic. 101 2020-03-13 19:44:57,820 [aws_consoler.logic] INFO: Boto3 session established. 102 2020-03-13 19:44:58,193 [aws_consoler.logic] WARNING: Creds still permanent, creating federated session. 103 2020-03-13 19:44:58,698 [aws_consoler.logic] INFO: New federated session established. 104 2020-03-13 19:44:59,153 [aws_consoler.logic] INFO: Session valid, attempting to federate as arn:aws:sts::123456789012:federated-user/aws_consoler. 105 2020-03-13 19:44:59,668 [aws_consoler.logic] INFO: URL generated! 106 https://signin.aws.amazon.com/federation?Action=login&Issuer=consoler.local&Destination=https%3A%2F%2Fconsole.aws.amazon.com%2Fconsole%2Fhome%3Fregion%3Dus-east-1&SigninToken=[REDACTED] 107 ``` 108 109 ## References 110 111 * [A short note on AWS KEY ID - Tal Be'ery - Oct 27, 2023](https://medium.com/@TalBeerySec/a-short-note-on-aws-key-id-f88cc4317489) 112 * [Gaining AWS Console Access via API Keys - Ian Williams - March 18th, 2020](https://blog.netspi.com/gaining-aws-console-access-via-api-keys/)