使用临时凭证通过curl 签署AWS SIGv4 请求

Question

我正在尝试使用curl来自假定角色的临时凭据向 API Gateway 发出 SIGv4 签名请求。我使用 进行此工作awscurl，它提供了传递（会话令牌）的选项--security_token。

awscurl --service execute-api -X POST -d '{}' https://aaaaaaaa.execute-api.eu-west-1.amazonaws.com/endpoint --region eu-west-1 --access_key ${AWS_ACCESS_KEY_ID} --secret_key ${AWS_SECRET_KEY} --security_token "${SESSION_TOKEN}"
{"response":{}}

但我无法使用标准使相同的请求成功curl：

curl --aws-sigv4 "aws:amz:eu-west-1:execute-api" --user '${AWS_ACCESS_KEY_ID}:${AWS_SECRET_KEY}' -XPOST https://aaaaaaaa.execute-api.eu-west-1.amazonaws.com/endpoint -d'{}'
{"message":"Forbidden"}

有谁知道如何使用传递会话令牌curl？

Answer 1

您需要向请求添加标头：

\n

-H "x-amz-security-token: $AWS_SESSION_TOKEN"\n

\n

至少它对我来说对EKS有用......

\n

\xe2\x9d\xaf curl https://eks.us-west-2.amazonaws.com/clusters/<cluster-name> --user "$AWS_ACCESS_KEY_ID":"$AWS_SECRET_ACCESS_KEY" --aws-sigv4 "aws:amz:us-west-2:eks"\n{"message":"The security token included in the request is invalid."}\n\n\xe2\x9d\xaf curl https://eks.us-west-2.amazonaws.com/clusters/<cluster-name> --user "$AWS_ACCESS_KEY_ID":"$AWS_SECRET_ACCESS_KEY" --aws-sigv4 "aws:amz:us-west-2:eks" -H "x-amz-security-token: $AWS_SESSION_TOKEN"\n{\n  "cluster": {...}\n}\n

\n