Configure and Use AWS CLI

This section explains how to configure the settings that the AWS Command Line Interface (AWS CLI) uses to interact with ARTESCA. These include your security credentials, the default output format, the default AWS Region, and the endpoint parameter.

Note

A subdomain is needed to perform AWS-CLI API calls.

Refer to the change domain procedure for hardware or software for more information.

Configure Credentials Using aws configure

The aws configure command is the fastest way to set up your AWS CLI installation. When you run this command, the AWS CLI prompts the user for the following pieces of information:

  • Access key ID

  • Secret access key

  • AWS Region

  • Output format

The AWS CLI stores this information in a profile (a collection of settings) named default in the credentials file. The information in this profile is used when running an AWS CLI command that does not explicitly specify a profile to use:

aws configure

The following example shows sample values. Replace them with your own values.

AWS Access Key ID [None]: AKIAIOSFODNN7EXAMPLE
AWS Secret Access Key [None]: wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY
Default region name [None]: us-east-1
Default output format [None]: json

Note

The --profile parameter can be used to create a profile with a custom name.

Warning

The credentials you store using AWS CLI are stored in plaintext in ~/.aws/credentials. Use temporary security credentials to reduce the risk of accidental credentials exposures.

Use Temporary Credentials as Environment Variables

Environment variables provide another way to specify configuration options and credentials, and can be useful for scripting or temporarily setting a named profile as the default. The following example illustrates how to use environment variables with temporary credentials returned by AssumeRole or AssumeRoleWithWebIdentity:

AWS_ACCESS_KEY_ID=<YOUR_ACCESS_KEY> \
AWS_SECRET_ACCESS_KEY=<YOUR_SECRET_KEY> \
AWS_SESSION_TOKEN=<YOUR_SESSION_TOKEN> \
aws ...

Set ARTESCA Endpoint with AWS CLI

To communicate with ARTESCA, the --endpoint-url parameter must be set to:

  • https://iam.<base-domain-name> for IAM calls

  • https://sts.<base-domain-name> for STS calls

  • https://s3.<base-domain-name> for S3 calls

Note

Make sure your /etc/hosts file is up to date. Refer to the General DNS Setup documentation for more information. If the ARTESCA SSL certificate is not trusted by your environment, the --no-verify-ssl parameter can be used to ignore SSL verifications, although it is not recommended.

Use AWS CLI with Temporary Credentials

Given the following environment:

  • The aws iam create-policy --policy-name my-policy --policy-document file://policy command from the create-role API documentation.

  • A set of temporary credentials:

    • AWS_ACCESS_KEY_ID=TJI70VEXAMPLEO7W

    • AWS_SECRET_ACCESS_KEY=lpi7hRMQD/EXAMPLEk

    • AWS_SESSION_TOKEN=eyJzYWx0IjoiR0VGEXAMPLEOOVAwcyJ9.

The output command, using environment variables, is:

AWS_ACCESS_KEY_ID=TJI70VEXAMPLEO7W \
AWS_SECRET_ACCESS_KEY=lpi7hRMQD/EXAMPLEk \
AWS_SESSION_TOKEN=eyJzYWx0IjoiR0VGEXAMPLEOOVAwcyJ9 \
aws --endpoint-url https://iam.<base-domain-name> \
iam create-policy --policy-name my-policy --policy-document file://policy

Use AWS CLI with Root Credentials (Account or IAM User)

Given the following environment:

  • The aws iam create-policy --policy-name my-policy --policy-document file://policy command from the create-role API documentation.

  • A set of temporary credentials:

    • AWS_ACCESS_KEY_ID=TJI70VEXAMPLEO7W

    • AWS_SECRET_ACCESS_KEY=lpi7hRMQD/EXAMPLEk

    • Saved in the artesca profile.

The output command, using environment variables, is:

aws --endpoint-url https://iam.<base-domain-name> \
--profile artesca iam create-policy --policy-name my-policy --policy-document file://policy

Common AWS CLI Parameters

AWS CLI accepts a set of common parameters for your AWS CLI usage. The following parameters are supported by ARTESCA:

  • --ca-bundle <string>

    Specifies the certificate authority (CA) certificate bundle to use when verifying SSL certificates. If defined, this option overrides the value for the profile setting ca_bundle and the AWS_CA_Bundle environment variable.

  • --cli-connect-timeout <integer>

    Specifies the maximum socket connect time in seconds. If the value is set to zero 0, the socket connect waits indefinitely and does not time out.

  • --cli-read-timeout <integer>

    Specifies the maximum socket read time in seconds. If the value is set to zero 0 the socket read waits indefinitely (is blocking) and does not time out.

  • --color <string>

    Specifies support for color output. Valid values are on, off, and auto. The default value is auto.

  • --debug

    A Boolean switch that enables debug logging. The AWS CLI by default provides cleaned up information on any successes or failures regarding command outcomes in the command output.

  • --endpoint-url <string>

    Specifies the URL to send the request to. For ARTESCA, the --endpoint-url https://iam.<base-domain-name> must be used.

  • --no-cli-auto-prompt

    Disables auto-prompt mode for a single command.

  • --no-cli-pager

    A Boolean switch that disables using a pager for the output of the command.

  • --no-paginate

    A Boolean switch that disables the multiple calls the AWS CLI automatically makes to receive all command results that creates pagination of the output. This means only the first page of your output is displayed.

  • --profile <string>

    Specifies the named profile to use for this command. To set up additional named profiles, you can use the aws configure command with the --profile option.