AWS credential profile changer
Excerpt from IAM Best Practices:
Delegate by using roles instead of by sharing credentials
You might need to allow users from another AWS account to access resources in your AWS account. If so, don't share security credentials, such as access keys, between accounts. Instead, use IAM roles. You can define a role that specifies what permissions the IAM users in the other account are allowed, and from which AWS accounts the IAM users are allowed to assume the role.
To make process of switching profiles (environment variables
AWS_SECRET_ACCESS_KEY among others) it is handy to use the code provided on this repo.
- Autocomplete of available profiles (
awsp + tab + tab)
- Support configurable location of credentials file (
- Full compatibility with official AWS CLI
- Assume roles which require MFA
- What else you can think of? Please open an issue or submit PR.
- jq should be installed
- Download awsp_functions.sh anywhere you like (for example,
~/awsp_functions.sh) and make it executable:
$ wget -O ~/awsp_functions.sh https://raw.githubusercontent.com/antonbabenko/awsp/master/awsp_functions.sh $ chmod +x ~/awsp_functions.sh
- Depending on which version of shell you use, edit
~/.bash_profileor similar to include:
- (Optional) Enable aliases and auto-completion into your
alias awsall="_awsListAll" alias awsp="_awsSwitchProfile" alias awswho="aws configure list" complete -W "$(cat $HOME/.aws/credentials | grep -Eo '\[.*\]' | tr -d '')" _awsSwitchProfile
[company-anton] aws_access_key_id=EXAMPLEACCESSKEY aws_secret_access_key=EXAMPLESECRETACCESSKEY [company-staging-anton] role_arn=arn:aws:iam::222222222222:role/company-staging source_profile=company-anton [company-production-anton] role_arn=arn:aws:iam::111111111111:role/company-production source_profile=company-anton mfa_serial=arn:aws:iam::333333333333:mfa/anton
To change AWS profile to use staging account (222222222222):
$ awsp company-staging-anton
To change AWS profile to use production account (111111111111) which requires MFA token created in IAM account (333333333333,
$ awsp company-production-anton # Please enter your MFA token for arn:aws:iam::333333333333:mfa/anton > 123456
This code has been tested only on Mac and there are no intentions to make it to work on other systems (if necessary), but PR are very much welcome!
Apache 2 Licensed. See LICENSE for full details.