AWS rolesanywhere documentation change
Summary
Updated credential helper version to 1.5.0 with new checksums, added requirements for temporary credentials, and release notes for version 1.5.0
Security assessment
Adds documentation about required security components (certificates, private keys) and updates security-sensitive binaries, but no explicit mention of vulnerability fixes. Version update mentions PKCS#12 support improvements but doesn't indicate security fixes
Diff
diff --git a/rolesanywhere/latest/userguide/credential-helper.md b/rolesanywhere/latest/userguide/credential-helper.md index 076b6abc3..97c030290 100644 --- a//rolesanywhere/latest/userguide/credential-helper.md +++ b//rolesanywhere/latest/userguide/credential-helper.md @@ -15,5 +15,19 @@ Platform | Architecture | Download URL | SHA256 checksum -Linux | x86-64 | [https://rolesanywhere.amazonaws.com/releases/1.4.0/X86_64/Linux/aws_signing_helper](https://rolesanywhere.amazonaws.com/releases/1.4.0/X86_64/Linux/aws_signing_helper) | 4166504134ffd368023b50a2c6f960d22e9be06ad4b4d03ecd9e647bf9d9a17b -Windows | x86-64 | [https://rolesanywhere.amazonaws.com/releases/1.4.0/X86_64/Windows/aws_signing_helper.exe](https://rolesanywhere.amazonaws.com/releases/1.4.0/X86_64/Windows/aws_signing_helper.exe) | e465ecb852be025f789de0c2460effa39410c26035a292b4cf0485062df59f2c -Darwin | x86-64 | [https://rolesanywhere.amazonaws.com/releases/1.4.0/X86_64/Darwin/aws_signing_helper](https://rolesanywhere.amazonaws.com/releases/1.4.0/X86_64/Darwin/aws_signing_helper) | 954f59b4aa091eb4c9cbad589dca76f99a23c56afedeeaf36beb4bca03a8466e -Linux | Aarch64 | [https://rolesanywhere.amazonaws.com/releases/1.4.0/Aarch64/Linux/aws_signing_helper](https://rolesanywhere.amazonaws.com/releases/1.4.0/Aarch64/Linux/aws_signing_helper) | 37d0ba5f8fecae8922424625541aaef38697ed44c20f729f4be62af7c0c0d324 -Darwin | Aarch64 | [https://rolesanywhere.amazonaws.com/releases/1.4.0/Aarch64/Darwin/aws_signing_helper](https://rolesanywhere.amazonaws.com/releases/1.4.0/Aarch64/Darwin/aws_signing_helper) | 2465901fbc47055b33d8adb9d92001bbbbbe0516f4e0d7815c2beccf54fca90a +Linux | x86-64 | [https://rolesanywhere.amazonaws.com/releases/1.5.0/X86_64/Linux/aws_signing_helper](https://rolesanywhere.amazonaws.com/releases/1.5.0/X86_64/Linux/aws_signing_helper) | 519717f2408f3191e0ec8b35531c41bf20344b94b292cf1d763df4e6fc93af44 +Windows | x86-64 | [https://rolesanywhere.amazonaws.com/releases/1.5.0/X86_64/Windows/aws_signing_helper.exe](https://rolesanywhere.amazonaws.com/releases/1.5.0/X86_64/Windows/aws_signing_helper.exe) | 673e649b6e260f3d0d594f1de66a07972bc90bd783b957bf48b974ff9ddf1681 +Darwin | x86-64 | [https://rolesanywhere.amazonaws.com/releases/1.5.0/X86_64/Darwin/aws_signing_helper](https://rolesanywhere.amazonaws.com/releases/1.5.0/X86_64/Darwin/aws_signing_helper) | 9f69f2ff5b277e4f38fc518da675b2cf2af8fc8a9e1ae096ae160d4d77ab7ee4 +Linux | Aarch64 | [https://rolesanywhere.amazonaws.com/releases/1.5.0/Aarch64/Linux/aws_signing_helper](https://rolesanywhere.amazonaws.com/releases/1.5.0/Aarch64/Linux/aws_signing_helper) | c01ae38181309a25cb3451c84b3cdaec8e9308ffd0b89015f3c667914050b053 +Darwin | Aarch64 | [https://rolesanywhere.amazonaws.com/releases/1.5.0/Aarch64/Darwin/aws_signing_helper](https://rolesanywhere.amazonaws.com/releases/1.5.0/Aarch64/Darwin/aws_signing_helper) | b90276a13145755793f26c832f6623a2640abb8f732654828a48aa3fdfd32f3e + +###### Important + +To get temporary credentials, you need all of the following: + + * A Profile configured in AWS Identity and Access Management Roles Anywhere + + * A Role ARN from IAM + + * An end-entity certificate from your certificate authority + + * The certificate associated private key is required in most cases, except when inferred. For example when using OS certificate stores. + + * A trust anchor configured in IAM Roles Anywhere @@ -21 +35,4 @@ Darwin | Aarch64 | [https://rolesanywhere.amazonaws.com/releases/1.4.0/Aarch64 -Before you can obtain temporary credentials, you must have both an end-entity certificate from the certificate authority and a trust anchor in IAM Roles Anywhere. For more information, see [Getting started](./getting-started.html). + + + +For more information, see [Getting started](./getting-started.html). @@ -124 +141,5 @@ The credential helper tool will return a JSON containing the credentials. This f -To obtain temporary security credentials, use the following command. +Use the following command to get temporary security credentials. Specify the Region where you want to make the request. + +###### Important + +Before you run this command, make sure you have your certificate and private key. To get these credentials, follow the documentation from your certificate authority. @@ -142,0 +164 @@ The following example shows a the `config` file that sets the helper tool as the + region = region @@ -149,0 +172,4 @@ The source code for the credential helper is available on [GitHub](https://githu +### CredentialHelper version 1.5.0 + +On April 3, 2025, AWS IAM Roles Anywhere released Credential Helper version 1.5.0. As a part of this release, an option was added to use the latest expiring certificate when multiple match a certificate selector, and some minor fixes were introduced related to PKCS#12 file support. +