aws / aws/aws-toolkit-azure-devops

roleArn on AWSShellScript

Open
#340 1 comment 4 reactions 0 assignees View on GitHub
guidance
Dominant language
TypeScript
Stars
258
Forks
114
PR merge metrics
No merged PRs in 30d

Description

In many cases I use AWSShellScript to execute aws cli commands, but I haven't seen a nice solution on how to run an AWSShellScript with an assumed role other than the serviceconnection role

Just like the CloudFormationCreateOrUpdateStack take a roleArn parameter and pass it to CloudFormation it would be nice if AWSShellScript could do the same, take a roleArn parameter and assume the role and execute the cli command

Right now i need to script my way out of it. (or am i missing something ?)

```
temp_role=$(aws sts assume-role --role-arn "arn:aws:iam::my_account:role/myrole" --role-session-name "MySession")
export AWS_ACCESS_KEY_ID=$(echo $temp_role | jq -r .Credentials.AccessKeyId)
export AWS_SECRET_ACCESS_KEY=$(echo $temp_role | jq -r .Credentials.SecretAccessKey)
export AWS_SESSION_TOKEN=$(echo $temp_role | jq -r .Credentials.SessionToken)
aws s3 ls my-bucket
```

Contributor guide

Open the contributing guide

Research direction

Start at the AWSShellScript task entry point and compare how CloudFormationCreateOrUpdateStack accepts and uses roleArn. Verify the requested roleArn behavior and confirm that an AWSShellScript command runs with the assumed role, adding or updating relevant tests if the task exposes them.

Written by the indexing model from the issue text.

Assessment

Tech stack
aws, typescript
Domain
cli, cloud
Issue type
Feature
Difficulty
3/5
Estimated time
1-2 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.