IAM SSH Key Managment for EC2s in AWS

Tons of credit to Widdix => https://github.com/widdix

A set of IAM policies and shell script for managing SSH keys centrally in AWS

On MASTER AWS IAM account

1. Create a role of the type "Another AWS account", pointing it at the Account ID of the child account. There must be a unique role for each of the child accounts. This can be found in the my account menu when logged into the child account.
2. Paste the contents of the iam-master-policy.json,replacing the MASTER account ID with the CHILD account ID. This .json is placed in the inline policy.
3. Name the policy iam-master-clientNameHere

On CLIENT AWS IAM account

1. Create an IAM, EC2 role
2. name it iam-client-clientNameHere
3. Attach an inline, custom policy with the contents form iam-child-policy.json adding the MASTER Account ID and the MASTER Role name that we just created
4. Attach newly created client role to instance. This can be done via the cli or the AWS EC2 GUI, by highlighting the instance > Instance Settings > Attach/replace IAM role > selecting newly created client role

On client EC2

1. sudo git clone https://github.com/giancarlopetrini/aws-iam-ssh.git /opt/aws-iam-ssh
2. cd /opt/aws-iam-ssh/linux-files
3. sudo chmod +x /opt/aws-iam-ssh/linux-files/new-install.sh && sudo chmod +x /opt/aws-iam-ssh/linux-files/new-import-iam-users.sh
4. sudo ./new-install.sh
5. sudo reboot
6. sudo nano /opt/aws-iam-ssh/linux-files/new-import-iam-users.sh
7. change value of IAM info on Line 74, in assume role call, to accurate information, based on the hints
8. sudo /opt/aws-iam-ssh/linux-files/./new-import-iam-users.sh

If the last command does not execute, follow the steps below

1. sudo yum reinstall python-pip
2. pip uninstall awscli
3. pip install --upgrade --user
4. Verify with aws --version