Support for AWS STS AssumeRole is required in the aws-cli docker image
- Dominant language
- Python
- Stars
- 17.3k
- Forks
- 4.6k
- Avg merge
- 1d 2h
- Merged PRs (30d)
- 13
Description
**Is your feature request related to a problem? Please describe.**
I have written my own docker image using AmazonLinux:2 as base image and then customized that to have aws-cli library. I was passing the .aws credentials as a volume mount to that container so that it can used and to assume role using the AWS STS service.
Can we have similar thing in this aws-cli docker image, where by passing the .aws credentials as volume mount, I can assumerole and can get temporary credentials set.
This is my solution snippet in my customized docker image:-
```
FROM amazonlinux:2 as dev
# ---------------------------------------------------------------------------- #
# Install AWS CLI #
# ---------------------------------------------------------------------------- #
# For SAM CLI
ARG SAM_CLI_VERSION=${SAM_CLI_VERSION:-1.1.0}
RUN set -eux; \
curl -fsSL https://awscli.amazonaws.com/awscli-exe-linux-x86_64.zip -o awscliv2.zip; \
unzip -qq awscliv2.zip; \
./aws/install -i /usr/local/lib/aws ; \
# put it in .bashrc file
# https://github.com/aws/aws-cli/issues/4950
# complete -C '/usr/local/aws/bin/aws_completer' aws
# aws cli cleanup
rm -rf awscliv2.zip ./aws; \
# Install SAM CLI in a dedicated Python virtualenv
curl -fsSLk https://github.com/awslabs/aws-sam-cli/archive/v$SAM_CLI_VERSION.zip -o samcli.zip; \
unzip -qq samcli.zip; \
python3 -m venv /usr/local/lib/sam-cli; \
/usr/local/lib/sam-cli/bin/pip3 --no-cache-dir install -r ./aws-sam-cli-$SAM_CLI_VERSION/requirements/reproducible-linux.txt; \
/usr/local/lib/sam-cli/bin/pip3 --no-cache-dir install ./aws-sam-cli-$SAM_CLI_VERSION; \
# cleanup
rm -rf samcli.zip aws-sam-cli-${SAM_CLI_VERSION}; \
echo ""
# add sam cli to PATH
ENV PATH=$PATH:/usr/local/lib/sam-cli/bin
COPY ./assume-role.sh .
RUN ["chmod", "+x", "assume-role.sh"]
ENTRYPOINT ["/assume-role.sh"]
CMD ["bash", "--"]
```
In my dockerfile, I'm passing an assume-role.sh file where I'm trying to generate the temporary credentials using AWS STS assumerole by using the .aws credentials mounted as a volume to it.
```
#!/usr/bin/env bash
#echo Your container args are: "${1} ${2} ${3}"
echo Your container args are: "${1}"
ROLE_ARN="${1}"
AWS_DEFAULT_REGION="${2:-us-east-1}"
SESSIONID=$(date +"%s")
DURATIONSECONDS="${3:-3600}"
# AWS STS AssumeRole
RESULT=(`aws sts assume-role --role-arn $ROLE_ARN \
--role-session-name $SESSIONID \
--duration-seconds $DURATIONSECONDS \
--query '[Credentials.AccessKeyId,Credentials.SecretAccessKey,Credentials.SessionToken]' \
--output text`)
# Setting up temporary creds
export AWS_ACCESS_KEY_ID=${RESULT[0]}
export AWS_SECRET_ACCESS_KEY=${RESULT[1]}
export AWS_SECURITY_TOKEN=${RESULT[2]}
export AWS_SESSION_TOKEN=${AWS_SECURITY_TOKEN}
echo 'AWS STS AssumeRole completed successfully'
# Making test AWS API calls
aws s3 ls
echo 'test calls completed'
```
So, the new feature request from my side is to have out of box capability of assuming a role by just passing AWS Role ARN while running the container where .aws credentials is mounted as a volume to the container in this aws-cli docker image as there are many use cases where this is a good fit.
Thank you
Contributor guide
Assessment
This issue has not been assessed yet.