Should be able to assume a role using AWS_PROFILE and 'credential_source=Environment'
- Dominant language
- Python
- Stars
- 17.3k
- Forks
- 4.6k
- Avg merge
- 1d 2h
- Merged PRs (30d)
- 13
Description
I have a profile configured that should assume a role, and wants to use the Environment (AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY) as the “source credentials” (those used to issue the ‘assume role’ request), as [documented here](https://docs.aws.amazon.com/cli/latest/topic/config-vars.html#using-aws-iam-roles):
`~/.aws/config:`
```
[profile myprofile]
region = myregion
credential_source = Environment
role_arn = arn:aws:iam::0123456789:role/myrole
```
Observe the identity that ends up being used:
```$ AWS_PROFILE=myprofile AWS_ACCESS_KEY_ID=AKIAXXXXX AWS_SECRET_ACCESS_KEY=XXXXXXX aws sts get-caller-identity```
The results show that the role was not assumed, and that the specified credentials were used directly.
Actual:
```
{
....
"Arn": "arn:aws:iam::xxxxxxxxxxxx:user/"
}
```
Expected:
```
{
....
"Arn": "arn:aws:sts::yyyyyyyyyyyy:assumed-role/myrole/botocore-session-xxxxxxx"
}
```
I have seen the [documentation regarding credentials precedence](https://docs.aws.amazon.com/cli/latest/topic/config-vars.html#id1) (which states that all three of these environment variables cannot be used together) but find this to be confusing. What is the purpose of `credential_source = Environment` in the config file then? If specifying the source credentials via the environment, would you not also want to specify the profile to be using the same mechanism? What is the usage where `credential_source = Environment` *would* be honored?
Apparently I'm not the only one confused by this (see #3304).
For clarification, the use case I'm trying to support is an automated process (or individual end user) that does not want to (or cannot) keep the AWS credentials in a plaintext file and instead needs to put them into temporary environment variables. This user wants to utilize the CLI to assume a role in order to execute commands (an AWS-recommended [best practice](https://docs.aws.amazon.com/IAM/latest/UserGuide/best-practices.html#delegate-using-roles)).
It is my (experientially confirmed) understanding that this is a use case that is not currently supported by the AWS CLI (other than manually invoking the role assumption and using the temporary credentials directly). My question is: will this use case ever be supported? Would a pull request that implements support for it be accepted? #3304 suggests an alternate environment variable to specify a profile for role assumption, is that acceptable?
Contributor guide
Assessment
This issue has not been assessed yet.