amazon-web-services - 如何使用 aws cdk 生成 IAM 服务特定凭证？

Question

我正在尝试弄清楚如何使用 AWS CDK 为 IAM 用户生成服务特定凭证。

我可以从以下方面了解如何实现这一目标:

• 管理控制台:IAM > 用户 > 安全凭证:
  • AWS CodeCommit 的 HTTPS Git 凭证，以及
  • Amazon Managed Apache Cassandra Service (MCS) 的凭证
• API:CreateServiceSpecificCredential
• 命令行:create-service-specific-credential

但是我看不出如何使用 AWS CDK(或就此而言从 Cloud Formation)实现这一点。

如果 CDK 目前不支持，那么推荐的方法是什么？

Answer 1

基于@JeffreyGoines 上面的回复，构造函数调用 CreateServiceSpecificCredential:

export class CodeCommitGitCredentialsProps {
  userName: string
}

export class CodeCommitGitCredentials extends Construct {
  readonly serviceSpecificCredentialId: string;
  readonly serviceName: string;
  readonly serviceUserName: string;
  readonly servicePassword: string;
  readonly status: string;

  constructor(scope: Construct, id: string, props: CodeCommitGitCredentialsProps) {
    super(scope, id);

    // Create the Git Credentials required
    const gitCredResp = new AwsCustomResource(this, "gitCredentials", {
      // https://docs.aws.amazon.com/AWSJavaScriptSDK/latest/AWS/IAM.html#createServiceSpecificCredential-property
      onCreate: {
        service: "IAM",
        action: "createServiceSpecificCredential",
        parameters: {
          ServiceName: "codecommit.amazonaws.com",
          UserName: props.userName
        },
        physicalResourceId: PhysicalResourceId.fromResponse("ServiceSpecificCredential.ServiceSpecificCredentialId")
      },
      // https://docs.aws.amazon.com/AWSJavaScriptSDK/latest/AWS/IAM.html#deleteServiceSpecificCredential-property
      onDelete: {
        service: "IAM",
        action: "deleteServiceSpecificCredential",
        parameters: {
          ServiceSpecificCredentialId: new PhysicalResourceIdReference(),
          UserName: props.userName
        }
      },
      policy: AwsCustomResourcePolicy.fromSdkCalls({
        resources: AwsCustomResourcePolicy.ANY_RESOURCE,
      }),
    });

    this.serviceSpecificCredentialId = gitCredResp.getResponseField("ServiceSpecificCredential.ServiceSpecificCredentialId");
    this.serviceName = gitCredResp.getResponseField("ServiceSpecificCredential.ServiceName");
    this.serviceUserName = gitCredResp.getResponseField("ServiceSpecificCredential.ServiceUserName");
    this.servicePassword = gitCredResp.getResponseField("ServiceSpecificCredential.ServicePassword");
    this.status = gitCredResp.getResponseField("ServiceSpecificCredential.Status");
  }
}

还有一个用法示例:

    // User created for Git Push/Pull
    this.user = new User(this, `codeCommitGitMirrorUser`, {
      userName: `${props.repository.repositoryName}-GitMirrorUser`
    });

    props.repository.grantPullPush(this.user);

    this.gitCredentials = new CodeCommitGitCredentials(this, "codeCommitGitCredentials", {
      userName: this.user.userName
    });