Set up a Certificate Authority.

Use AWS Private Certificate Authority to create a certificate authority and install a CA certificate to activate the certificate authority.

Configure IAM Roles Anywhere.

In IAM Roles Anywhere, create a Trust Anchor using the certificate authority that you created.
Create an IAM role with the minimal S3 permissions and a trust policy that allows IAM Roles Anywhere to assume it.
Create a profile in the IAM Roles Anywhere console, linking the IAM role to the trust anchor.

Generate and download the certificate.

In AWS Certificate Manager, request and obtain a private certificate associated with your certificate authority.
Download and export the certificate body, certificate chain, and certificate private key.
Decrypt the private key using OpenSSL.
Place the private key, decrypted private key, and the certificate in a local directory.

Install IAM credentials helper and use the

aws_signing_helper

tool to request temporary credentials through the CreateSession API.

Create an AWS credentials file with the profile details including ARNs and paths to certificate and key files.

Specify the following parameters in the credential profile file:

<agent_loc>\aws_signing_helper.exe
. The path to the AWS Credentials Helper tool.
--certificate <agent_loc>\certificate.pem
. The path to the X.509 certificate file. This certificate is used to authenticate the identity requesting temporary credentials from IAM Roles Anywhere.
--private-key <agent_loc>\decrypted_private_key.pem
. The path to the decrypted private key corresponding to the certificate.
--trust-anchor-arn <arn of trust anchor>
. The Amazon Resource Name (ARN) of the trust anchor that establishes trust between IAM Roles Anywhere and the certificate authority.
--profile-arn <arn of profile>
. The ARN of the profile configured in IAM Roles Anywhere. Profiles specify which IAM roles can be assumed and what operations can be performed with the temporary security credentials issued.
--role-arn <arn of role>
. The ARN of the IAM role that the credentials helper assumes.
--session-duration <time in seconds>
. The duration during which the temporary session credentials is valid. This parameter is optional.

The following sample shows a credential profile file:

[profile_name]
credential_process = <Secure Agent installation drirectory>\aws_signing_helper.exe credential-process --certificate <agent_loc>\certificate.pem --private-key <agent_loc>\decrypted_private_key.pem --trust-anchor-arn <arn of trust anchor> --profile-arn <arn of profile> --role-arn <arn of role> --session-duration <time in seconds>

Rules for credential profile file

The credential profile file must be on the Secure Agent machine.
The credential profile file must have a
.credentials
extension.
If you do not specify the credential profile path, the Secure Agent uses the credential profile file present in the following default location in the home directory:
~/.aws/credentials
On Windows, you can refer to your home directory by using the environment variable
%UserProfile%
. On Unix-like systems, you can use the environment variable
$HOME
.