kunickiaj/gcp-sa-to-aws-iam-role

Example code for using a GCP Service Account to acquire AWS IAM Role credentials

Python

GCP Service Account to AWS IAM Role

This repo contains code that accompanies the blog post on using GCP Service Accounts to acquire AWS IAM Role credentials.

Preparation

Create the GCP Service Account
Get the Service Account numeric Client ID

Creating the stack

Acquire AWS credentials with rights to manage IAM Identity Providers, Lambda functions, and IAM Roles.

Build the rendered template and create the stack:

CLIENT_ID=<service-account-client-id> make deploy

Copy the ARN of the role from the Outputs of the stack

Acquiring Credentials

Create an Ubuntu VM in GCP, and associate the Service Account you created above with it
Log in to that VM

Install pre-requisites:

apt-get update && apt-get install -y python3-pip

Download this repo onto that system:

curl -L -o gcp-to-aws.zip https://github.com/cevoaustralia/gcp-sa-to-aws-iam-role/archive/master.zip

Unpack the repo:
```
unzip gcp-to-aws.zip
```

Install the dependencies:

cd gcp-sa-to-aws-iam-role-master/gcp
pip3 install -r requirements.txt

Run the script with the ARN of the IAM Role created by the stack (above) as the argument:
```
./get_aws_creds.py arn:aws:iam::123456789012:role/DeploymentRole
```
Validate that your VM now has AWS credentials:
```
aws sts get-caller-identity
```
Profit!