58 lines
1.5 KiB
Markdown
58 lines
1.5 KiB
Markdown
# AWS Credentials
|
|
|
|
## Credential Generation
|
|
|
|
```bash
|
|
export AWS_USERNAME=
|
|
aws iam create-user --user-name $AWS_USERNAME
|
|
aws iam create-access-key --user-name $AWS_USERNAME
|
|
|
|
# Allow updating reeseapps
|
|
aws iam attach-user-policy --user-name $AWS_USERNAME --policy-arn arn:aws:iam::892236928704:policy/update-reeseapps
|
|
|
|
# Allow updating reeselink
|
|
aws iam attach-user-policy --user-name $AWS_USERNAME --policy-arn arn:aws:iam::892236928704:policy/update-reeselink
|
|
```
|
|
|
|
## AWS Certbot Route53 Policies
|
|
|
|
Example Policy:
|
|
|
|
secrets/aws/policies/route53_reeselink.json
|
|
|
|
```json
|
|
{
|
|
"Version": "2012-10-17",
|
|
"Statement": [
|
|
{
|
|
"Effect": "Allow",
|
|
"Action": [
|
|
"route53:ListHostedZones",
|
|
"route53:GetChange"
|
|
],
|
|
"Resource": [
|
|
"*"
|
|
]
|
|
},
|
|
{
|
|
"Effect": "Allow",
|
|
"Action": [
|
|
"route53:ChangeResourceRecordSets",
|
|
"route53:ListResourceRecordSets"
|
|
],
|
|
"Resource": [
|
|
"arn:aws:route53:::hostedzone/<zone_id>"
|
|
]
|
|
}
|
|
]
|
|
}
|
|
```
|
|
|
|
```bash
|
|
# Allow updating route53 records for reeselink.com
|
|
aws iam create-policy --policy-name update-reeselink --policy-document file://secrets/aws/policies/route53_reeselink.json
|
|
|
|
# Allow updating route53 records for reeseapps.com
|
|
aws iam create-policy --policy-name update-reeseapps --policy-document file://secrets/aws/policies/route53_reeseapps.json
|
|
```
|