Working with AWS credentials using PowerShell

• Author
• Recent Posts

Graham Beer

Graham is an experienced system engineer with a passion for PowerShell and automation. You can follow his blog or reach him on Twitter at @GKBeer.

Latest posts by Graham Beer (see all)

• A Go AWS SDK example - Fri, Nov 11 2022
• Getting started with Jenkins - Tue, Aug 16 2022
• Pulumi vs. Terraform - Tue, Jul 5 2022

Before continuing, note that I'll be using the PowerShell core module in this article. The details can be found in the PowerShell Gallery. To install from the console, make sure you are using PowerShell Core, and run the following:

Install-Module - Name AWSPowerShell.NetCore

Creating access keys

To use AWS programmatically from PowerShell, you need to generate your access keys. To do this, sign into the AWS console, and from the Services tab, select IAM under Security, Identity, & Compliance. From the left-hand side, select Users, and find the username you want to generate access keys for. Change the tab to Security Credentials, and then click on Create access key. You'll be able to continue viewing the access key, but the secret key generated is a one off, so make a note of this.

Creating your access key profile

Now that you have your access key and secret key, you can create your profile on the local machine by following this syntax:

Set-AWSCredentials -AccessKey {xx} -SecretKey {xx} -StoreAs {MyProfileName}

By default, the profile is created and placed in the SDK Store at C:\Users\<username>\AppData\Local\AWSToolkit. You can write the file to a chosen location by using the parameter ProfilesLocation to the Set-AWSCredentials cmdlet with the desired path.

The credential file is stored in JSON format and named RegisteredAccounts.

The SDK Store

Let's take a quick look into the advantages of storing credentials in the SDK Store.

• The credentials stored in the JSON file are encrypted and located under the user's home directory. This makes it more hidden to someone looking at your machine.
• The profile is referenced by name in your code or application and calls the associated credentials at run time. The code calling and using the profile never contains the credentials.
• If you name your profile default, the AWS SDK for .NET uses this profile. This can be useful when interacting with AWS through PowerShell because you don't need to invoke the profile.
• The SDK Store can contain multiple profiles from any number of accounts.

Viewing your profiles

You can view your profiles through the Get-AWSCredential cmdlet, like this:

Get-AWSCredential -ListProfileDetail

The return will look similar to that in the next screenshot.

Viewing profiles stored on your machine

You can also view the JSON file, which holds your profiles and the encrypted information, like this:

$PSCoreCredPath = "C:\Users\$env:USERNAME\AppData\Local\AWSToolkit"
cd $PSCoreCredPath
Get-Content -Path .\RegisteredAccounts.json

Piping Get-Content to Select-String will confirm what Get-AWSCredential returned for the ProfileName:

Get-Content -Path .\RegisteredAccounts.json | Select-String -SimpleMatch "DisplayName" 

Profile names viewed from the JSON file 

Calling a named profile

You might be using more than one profile to access different areas of AWS. You might have one to create EC2 instances and another for viewing S3 buckets. To invoke a profile if it's named something other than default, you can use the cmdlet Initialize-AWSDefaultConfiguration. To see how this works, I'll call the MyAWS profile:

Initialize-AWSDefaultConfiguration -ProfileName MyAWS -Region eu-west-1

Note the use of the Region parameter, which needs to be added when initializing a profile; otherwise, the cmdlet will prompt you to enter one. Now this profile is available to use. By initializing a profile in this way, you populate two AWS automatic variables, one with the profile and the other with the region:

$StoredAWSCredentials
$StoredAWSRegion

You can use these automatic variables when running a command by calling the ProfileName parameter:

Get-S3Bucket -ProfileName $StoredAWSCredentials

The removal of an active profile

To complete the trip around AWS credentials, we now come to removing a profile from the stored credentials file via the Remove-AWSCredentialProfile cmdlet:

Remove-AWSCredentialProfile -ProfileName MyAWS -Confirm:$false

When removing the profile name from the RegisteredAccounts.json, the cmdlet will prompt you to make sure you want to do this. I've passed the confirm parameter with the value of false to skip this prompt.

Summary

AWS provides a secure way to work with access keys and secrets through the AWS .NET SDK. The file generated is well encrypted and gives you the flexibility to have more than one access key available on your local machine. Naming the profile Default allows you to work with PowerShell immediately without the need to initialize a profile.