AWS Consoler

Original Research: Ian Williams
Link to Tool: aws_consoler
Alternative Tool: aws-vault


It is a good idea to install AWS Consoler in a Docker container or other disposable environment. The dependencies on the project may affect your existing AWS CLI install.


AWS Consoler is an excellent tool to convert IAM credentials into an AWS Console session, however it is no longer maintained. As a result, you may prefer to instead use something like aws-vault (v6.6.0+) which can perform a similar functionality. In the future this page may be deprecated in favor of creating a more generalized technique (rather than being tied to a specific tool).

When performing an AWS assessment you will likely encounter IAM Credentials. Traditionally, the majority of these that you would find would only be usable from the AWS CLI. Using a tool called AWS Consoler you can create links that will allow you to access the AWS Console. In this example we will walk through gathering credentials and using those credentials along with Consoler to generate a Console link.

First, we need to gather valid IAM credentials. These are typically found a number of different ways. In this example, we have shell access to an EC2 instance with an attached role and we will curl the metadata service to access them.

Stolen Credentials

Next, install and compile AWS Consoler (install Python dependencies with pip and then do a sudo make install).

From here invoke the Consoler tool and provide the -a (access key) -s (secret access key) and -t (session token) flags along with the retrieved values.


This will generate a link you can use to access the AWS Console.