Assume role source creds from environment

[alexrudd]

Hi,

Currently the only way to assume a role involves specifying at least a role_arn and a source_profile in a credentials file.

If the source_profile variable were made optional and aws-cli fell back to using credentials defined in the environment or in an EC2 instance profile, then this would be a much more flexible feature for situations where persisting credentials to a file isn't possible.

My particular situation is needing to deploy a website to an s3 bucket from jenkins. Jenkins can seed the workspace environment with credentials in environment vars, but aws-cli has no way of using these to assume a role.

This is similar to the feature requests in the following issues:

• Ability to assume role via cli parameter option a la --profile #2664
• Environment variables for assume role #2590
• Feature request: Assume role with EC2 instance profile as the source profile #1390
• Assume a role from IAM role configuration #2924

Thanks

[dstufft]

Marking this as a feature request, thanks!

[lorengordon]

This actually isn't supported, nor fixed in boto/botocore#1313... When using role_arn, either source_profile or credential_source is required.

the profile:

[profile mock]
role_arn = arn:aws:iam::ACCOUNT_ID:role/ROLE_NAME

❯ aws sts get-caller-identity --profile mock

Partial credentials found in assume-role, missing: source_profile or credential_source

[alexrudd]

@lorengordon is using the credential_source setting not a possibility in your above example?

[profile mock]
role_arn = arn:aws:iam::ACCOUNT_ID:role/ROLE_NAME
credential_source = Environment

[lorengordon]

@alexrudd Oh yes, of course that works. But I thought you were expecting it to fall through to getting the initial credential from the default credential chain, and then assume the specified role. I suppose in my head I was linking this feature to #2664, as a pre-requisite for being able to pass --role-arn on the cli. Having to pass both --role-arn and --credential-source or --source-profile seems less convenient... If I want to start from a profile on the cli, I would use AWS_PROFILE or --profile along with --role-arn. If that worked on the cli, then the config option could work the same way.

[alexrudd]

Ah I see what you mean. Yeah it would be nice if it fell back to the default credential chain. Might be worth opening a separate issue as I don't think this will be tracked anymore

[kdaily]

@alexrudd - I think this open issue is what you're looking for!

#3875