CODEWITHSUNDEEP
amazon-web-servicesaws-sdkaws-cli
overexchange
overexchange

Reputation: 1

Temporary Security Credentials - How to get access, given a role name & AWS account id?

AWS documentation provides multiple approach, here.

In our environment, we have multiple AWS accounts.

Usage scenario is to switch between AWS accounts and run AWS cli commands from laptop, as part of automation.

Before running AWS cli command on a specific AWS account, we need to get temporary credentials for that account, given account id.

Getting access to(by switching over) multiple AWS accounts, helps us in automation.

Basically we would like to run some tool like ./some_aws_sdk_tool.py role_name aws_account_name, assuming a role_name to get credentials.

I want to test this with my single AWS account(personal).

1) What are the steps to configure my AWS account to create such role_name?

2) What is the approach to get temporary credentials to a specific aws_account_name with some_aws_sdk_tool.py? to be able run AWS CLI commands for n minutes..

Upvotes: 0

Views: 5793

Answers (2)

parsifal
parsifal

Reputation: 373

Do you want to do this from within your code or using the AWS CLI?

If you're using the CLI, the easiest way is to create profiles in your AWS credentials file, as described here. Each profile identifies a role ARN and the source login information that is allowed to assume that role.

Alternatively, you can run the sts assume-role command, parse the results, and set environment variables:

aws sts assume-role --role-arn 'arn:aws:iam::123456789012:role/Example' --role-session-name 'some_unique_but_relevant_string'

{
    "Credentials": {
        "AccessKeyId": "ASIAXXXXXXXXXXXXXXXX",
        "SecretAccessKey": "XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX",
        "SessionToken": "XXXXXXXXXXXXXXX//////////XXX...XXXXX",
        "Expiration": "2020-03-05T20:57:45Z"
    },
    "AssumedRoleUser": {
        "AssumedRoleId": "AROAXXXXXXXXXXXXXXXXX:some_unique_but_relevant_string",
        "Arn": "arn:aws:sts::123456789012:assumed-role/Example/some_unique_but_relevant_string"
    }
}

If you want to do it from within your program, you can use code like this:

sts_client = boto3.client('sts')

role_arn = "..."
session_name = "some_unique_but_relevant_value"

response = sts_client.assume_role(
    RoleArn=role_arn,
    RoleSessionName=session_name
)
creds = response['Credentials']

actual_client = boto3.client('SERVICE',
    aws_access_key_id=creds['AccessKeyId']
    aws_secret_access_key=creds['SecretAccessKey']
    aws_session_token=creds['SessionToken'])

Upvotes: 3

Stargazer
Stargazer

Reputation: 1530

That is not possible. You can only see a secret key on the first time it gets created, AWS will never show it to you again. See more here.

Some Identity Managers like Okta allow you to assume roles on CLI so you don't have to deal with credentials directly. You just assign a role to an user and he will be able to assume the role directly after the first login.

Upvotes: 1

Related Questions