CODEWITHSUNDEEP
aws-cli
user3089927
user3089927

Reputation: 3885

passing access and secret key aws cli

I am trying to embed access and secret key along with aws cli. e.g.

aws ec2 describe-instances --aws-access-key <access_key> --aws-secret-key <secret_key>

Also tried with -o and -w options for access and secret key respectively. It says : Unknown option aws-access-key and aws-secret-key

Upvotes: 106

Views: 190098

Answers (11)

costamatrix
costamatrix

Reputation: 710

I had to access multiple accounts on Amazon. My solution:

Under ~/.aws/config:

[default] 
aws_access_key_id=xxxx
aws_secret_access_key=xxxxxx
region=sa-east-1
output=text
 
[profile prof1]
region=us-east-1 
output=text 
aws_access_key_id=yyy
aws_secret_access_key=yyyyy

[profile prof2] 
region=us-east-1 
output=text 
aws_access_key_id=wwwwww 
aws_secret_access_key=wwwww

...and then when evoke the AWS CLI, I passed the parameter --profile as follows:

/usr/local/bin/aws ec2 describe-security-groups --group-ids sg-xxxx --profile prof2

Upvotes: 16

Niharika
Niharika

Reputation: 1

Use the access key and id is not recommended as it will be stored in config file. Better approach is to create an IAM role and give required access which you need.

Upvotes: -2

ulubeyn
ulubeyn

Reputation: 3021

You can set credentials with:

aws configure set aws_access_key_id <yourAccessKey>
aws configure set aws_secret_access_key <yourSecretKey>

Verify your credentials with:

aws sts get-caller-identity

For more information on set command:

aws configure set help

General pattern is:

aws <command> help
aws <command> <subcommand> help

Note: Before overriding your credentials, you may want to keep a copy of it:

aws configure get aws_access_key_id
aws configure get aws_secret_access_key

Upvotes: 80

grepit
grepit

Reputation: 22382

I think the previous answers are correct, here is my response which is more like Danh response but also including multiple options and Windows too

Linux/Mac

export AWS_ACCESS_KEY_ID=your_key; export AWS_SECRET_ACCESS_KEY=your_secret;  aws s3 ls

Another way to skin a cat for Linux/Mac

AWS_ACCESS_KEY_ID=your_key AWS_SECRET_ACCESS_KEY=your_secret aws s3 ls

Windows Powershell

$Env:AWS_ACCESS_KEY_ID="your_key"
$Env:AWS_SECRET_ACCESS_KEY="your_secret"
aws s3 ls

Full credit to great AWS document

Upvotes: 27

pacificgilly1992
pacificgilly1992

Reputation: 432

Another method is to use echo with aws configure as a one-liner:

echo -ne '%s\n%s\n%s\n%s\n' <access_key> <security_key> <region> <output> | aws configure

Upvotes: 1

Prashanth Sams
Prashanth Sams

Reputation: 21129

enter image description here

To access aws through cli,

aws configure

Upvotes: 1

Evgeniy Kuzmin
Evgeniy Kuzmin

Reputation: 2462

You should store your credentials to ~/.aws/config file (or .aws/credentials)

More info how to setup it http://docs.aws.amazon.com/cli/latest/reference/configure/index.html

Also as alternative way you can create IAM role and certain policy and set it to you ec2 instance where you will use aws cli, then you won't need any credentials setup there

Upvotes: -2

LHWizard
LHWizard

Reputation: 2379

Summarizing the aws doc, there several ways to pass credentials to the command line. Please note that there are no command line options to pass in the the key and secret key directly. The "provider chain" is used instead.

In my bash scripts, I often use environment variables. To add a tiny bit of security, I source a file containing the variables rather than putting them in the script. With named profiles, it's even easier.

The provider chain is:

  1. command line options: specify region, output format, or profile
  2. Environment variables: AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY, and AWS_SESSION_TOKEN
  3. The AWS credentials file – located at ~/.aws/credentials on Linux, macOS, or Unix, or at C:\Users\USERNAME .aws\credentials on Windows. This file can contain multiple named profiles in addition to a default profile.
  4. The CLI configuration file – typically located at ~/.aws/config on Linux, macOS, or Unix, or at C:\Users\USERNAME .aws\config on Windows. This file can contain a default profile, named profiles, and CLI specific configuration parameters for each.
  5. Container credentials – provided by Amazon Elastic Container Service on container instances when you assign a role to your task.
  6. Instance profile credentials – these credentials can be used on EC2 instances with an assigned instance role, and are delivered through the Amazon EC2 metadata service.

Upvotes: 14

MaxNevermind
MaxNevermind

Reputation: 2923

You can also use aws configure:

$ aws configure
AWS Access Key ID [None]: xxxxxxxxxxxxxxxxxxxxxxxxx
AWS Secret Access Key [None]: xxxxxxxxxxxxxxxxxxxxxxxxx

Upvotes: 10

DanH
DanH

Reputation: 5818

You can provide keys on the command line via envars:

AWS_ACCESS_KEY_ID=ABCD AWS_SECRET_ACCESS_KEY=EF1234 aws ec2 describe-instances

See http://docs.aws.amazon.com/cli/latest/topic/config-vars.html#credentials

EDIT: @wisbucky noted this could leave secrets in your command history. One way around this in bash at least I think is to prepend your command with a blank space and the command should not propagate to your bash history.

Upvotes: 161

Peycho Dimitrov
Peycho Dimitrov

Reputation: 1407

Its the best way and more secure to use IAM roles. There you can set specific rights to this instance and what it has to access in your account.

Depending on what awscli version you use you can use describe-instances in a couple ways.

Like this one:

ec2din -O your-key -W your-secret-key --region your-region

Also there is a big difference when you install awscli with pip install or from pkg like ubuntu deb package.

ec2din is a short command to ec2-describe-instances

More examples here: ec2-describe-instances

Regards.

Upvotes: 3

Related Questions