发出临时证书以使用AssumeRole，现有策略和唯一URL登录到AWS管理控制台

我想向临时用户颁发临时凭证，以通过向他们提供使用这些临时凭证创建的URL来允许他们访问AWS管理控制台。

我将跟着通过AWS文档给出的书面示例：使用IAM查询API的示例代码

我编写了以下代码，该代码在执行时不会出现任何错误，并且似乎返回了会话令牌，这应该允许我正确地形成一个用于登录的URL。

这是返回会话令牌和随后URL的代码：

$accessKeyId = 'accesskeyId' 
$secretAccessKey = 'secretaccessKey'
$region = 'us-east-1'

Set-AWSCredentials -AccessKey $accessKeyId -SecretKey $secretAccessKey

$role = Use-STSRole -RoleSessionName "testSTS" -RoleArn "arn:aws:iam::1234567890:role/adminAccess" -DurationInSeconds 900

$jsonSession = @"
{
    "sessionId": $([string]::Format("{0}", $role.Credentials.AccessKeyId)),
    "sessionKey": $([string]::Format("{0}", $role.Credentials.SecretAccessKey)),
    "sessionToken": $([string]::Format("{0}", $role.Credentials.SessionToken))
}
"@

Add-Type -AssemblyName System.Web
$Encode = [System.Web.HttpUtility]::UrlEncode($jsonSession)

$url = $([string]::Format("https://signin.aws.amazon.com/federation?Action=getSigninToken&Session={0}", $Encode))

$payload = Invoke-WebRequest -Uri $url | ConvertFrom-Json

$issuer = [System.Web.HttpUtility]::UrlEncode("https://1234567890.signin.aws.amazon.com")
$destination = [System.Web.HttpUtility]::UrlEncode("https://console.aws.amazon.com")
$signintoken = [System.Web.HttpUtility]::UrlEncode($payload.SigninToken)

$signInUrl = $([string]::Format("https://signin.aws.amazon.com/federation?Action=login&Issuer={0}&Destination={1}&SigninToken={2}", $issuer, $destination, $signintoken))

write-host $signInUrl

不幸的是，当我在Web浏览器中访问URL时，出现以下错误“ Amazon Web Services登录：您的登录链接中的凭证无效。请与管理员联系。”

这是返回给我的url的样子，显然出于安全原因，我更改了accountid和真实会话令牌：

https://signin.aws.amazon.com/federation?Action=login&Issuer=https%3a%2f%2f1234567890.signin.aws.amazon.com&Destination=https%3a%2f%2fconsole.aws.amazon.com&SigninToken=ygQQrk4MYJyX1k30QBJJ5H3AQJ5H3AQJ5A3J5O3MJJ5U3A1J3Q3A0J1J3Q3A0J0J0J0Q0J0J0J0Q0Q人ADCYP5QHNj2rsBz4ATlHrHqIJlzoAqyPrd_5OC4fo-BNHGKJkfasfkjz4C4hZnfYH-VmmcHIY8Fan0m38SnxwCome8DZHLe-_8igsGmCWKKTAVen_lp5wA0mUuGIgg9TqPIlb5SNPOVY00oc3dEGZnahcBlOJAmN7DWuv3P61EVipF5w2eoSGIdCyPkhZ2vvFD8orN_UJ4nLogkTAf5rvme1cavj6sqmRUS8iOTyEj8a5mLrmWww__p_J3z4aN4U_qEr3SIi9tCmQMCPB6ktaN_-dMIvJMrx23C11KjCyqixHnFxn60MOBH22bmY-6OFOucA

另外，传递给我的凭据和sessiontoken在使用它们发出API命令时似乎很有效，如下面的代码所示：

$accessKeyId = 'accesskeyId' 
$secretAccessKey = 'secretAccessKey'
$region = 'us-east-1'

Set-AWSCredentials -AccessKey $accessKeyId -SecretKey $secretAccessKey

$role = Use-STSRole -RoleSessionName "testSTS" -RoleArn "arn:aws:iam::1234567890:role/adminAccess" -DurationInSeconds 900

$newAccessKeyId = $role.Credentials.AccessKeyId
$newSecretKey = $role.Credentials.SecretAccessKey
$newSessionToken =  $role.Credentials.SessionToken

Set-AWSCredentials -AccessKey $newAccessKeyId -SecretKey $newSecretKey -SessionToken $newSessionToken 

$secgroups = Get-EC2SecurityGroup

更新：我尝试删除“ issuer”参数，因为下面建议的文章将其列为可选参数。我还尝试将“ SessionType”添加到原始URL中以请求sessiontoken，并且登录URL仍然失败，并出现相同的错误。