#!/bin/bash
# Variables
ROLE_NAME="robot-artifact-iam-role"
POLICY_ARN="arn:aws:iam::aws:policy/AWSArtifactReadOnlyAccess"
KEY_PAIR_NAME="robot-artifact-key-pair"
# 步骤 1:为 AWS Artifact 创建 IAM 角色
echo "正在创建 IAM 角色:$ROLE_NAME"
aws iam create-role \
--role-name "$ROLE_NAME" \
--assume-role-policy-document '{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Action": "sts:AssumeRole",
"Principal": {
"Service": "artifact.amazonaws.com"
}
}
]
}' > create_role_output.json
# 检查 IAM 角色是否创建成功
if [ $? -eq 0 ]; then
echo "IAM 角色 $ROLE_NAME 创建成功。"
else
echo "创建 IAM 角色 $ROLE_NAME 失败。"
exit 1
fi
步骤 2:为角色附加 Artifact 访问策略
echo "正在将 AWSArtifactReadOnlyAccess 策略附加到 IAM 角色 $ROLE_NAME"
aws iam attach-role-policy \
--role-name "$ROLE_NAME" \
--policy-arn "$POLICY_ARN"
if [ $? -eq 0 ]; then
echo "策略附加成功。"
else
echo "附加策略失败。"
exit 1
fi
步骤 3:创建 IAM 访问密钥(用于编程访问)
echo "正在为 IAM 角色创建访问密钥:$ROLE_NAME"
aws iam create-access-key \
--user-name "$ROLE_NAME" \
> access_keys_output.json
# 检查密钥是否创建成功
if [ $? -eq 0 ]; then
echo "访问密钥创建成功。"
ACCESS_KEY_ID=$(jq -r '.AccessKey.AccessKeyId' access_keys_output.json)
SECRET_ACCESS_KEY=$(jq -r '.AccessKey.SecretAccessKey')
echo "访问密钥 ID:$ACCESS_KEY_ID"
echo "私密访问密钥:$SECRET_ACCESS_KEY"
else
echo "创建访问密钥失败。"
exit 1
fi
步骤 4:显示 IAM 角色和访问密钥信息
echo "IAM 角色 $ROLE_NAME 已创建,附加策略:$POLICY_ARN"
echo "访问密钥 ID:$ACCESS_KEY_ID"
echo "私密访问密钥:$SECRET_ACCESS_KEY"