Feature request: Assume role with EC2 instance profile as the source profile

Right now you can execute commands using credentials from one of these sources: root credentials, IAM credentials, temporary credentials from an EC2 instance profile, and temporary credentials from assuming a role via IAM credentials. I would like to execute commands by using temporary credentials from assuming a role via the EC2 instance profile.

I need this ability because I'm using two AWS accounts and I'm using an EC2 instance to run AWS CLI commands against both accounts. The EC2 instance profile allows me to perform tasks for one account, but I need to assume a cross-account role to perform tasks for the other account. Unfortunately there is no way to get AWS CLI to assume the cross-account role even though the EC2 instance profile has permissions to assume that role.

I tried removing the source_profile property from my role-based profile in hopes that the source_profile would use the instance profile, but that failed. After looking at AssumeRoleProvider in awscli/customizations/assumerole.py, I see that AWS CLI can only assume a role if the source profile has actual credentials in the config file. So currently that excludes any use of an instance profile to assume a different role.

[kyleknap]

Marking as feature request.

I've implemented a change to assumerole.py that accomplishes the goal in the feature request. In my implementation, AssumeRoleProvider falls back to directly calling InstanceMetadataProvider if the source profile is missing. Although this meets my use-case, I'm not sure if this is the approach that others would be pleased with. For one thing, there is no fallback to environment variables or another role. And the InstanceMetadataProvider created is actually a separate instance from the one created in botocore's create_credential_resolver() function.

I was hoping to implement it in such a way that that roles could be assumed to an arbitrary depth (a role is assumed from a role which is assumed from a role... etc.) and the ending source profile could be any valid credential provider (Environment variables, IAM credentials, instance metadata, etc.). The current credential resolver structure in botocore doesn't make it easy to do this. The create_credential_resolver() function is written with the assumption that you can create the credential resolver with the one profile you've selected and you won't need another.

Should I submit my pull request for the simplified version that just directly calls the InstanceMetadataProvider, or is a more robust implementation required? The better version probably would require some changes to botocore.

[ColinHebert]

@pgcp Would you mind submitting your solution? It should get the ball rolling for this issue.

[bflad]

Just ran into this myself! Albeit without visible text around 'aws_access_key_id' as seen below in the pip installed AWS CLI 1.9.9 on an Ubuntu 14.04 machine:

$ aws --profile otheraccount ec2 describe-instances

'aws_access_key_id'
$ cat ~/.aws/config
[default]
region=us-east-1

[profile otheraccount]
source_profile = default
role_arn = arn:aws:iam::############:role/my_other_accounts_role

[ColinHebert]

@kyleknap, is it possible to consider adding this issue to the roadmap?

[kyleknap]

@ColinHebert This is a feature we would like to add as we have gotten multiple requests for it and it would be useful. However, we do not have a timetable for when it will get done. When we start making progress on this feature, the issue will be updated.

[craigday]

This is just a "me too" comment. Ran into exactly this problem today. Please implement this functionality. The model (at least) seems to suggest it should work this way.

[keith-mason-conning]

+1. Just hit this problem myself. @pgcp please do submit your changes as a pull request. Even if it ultimately gets rejected, it'll help get the correct change made. I looked at assumerole.py, and it wasn't obvious to me what that change would look like.

[josefsachsconning]

Echoing s2maki, @pgcp it would be great to see a pull request. Thanks in advance.

[reppard]

I've ran into this myself. Just my +1 here.

[inhumantsar]

+1