How can I create profiles in the AWS CloudShell to access different roles?

Question

The new CloudShell service from AWS allows me to get a CLI session directly within the browser. In this session, I am acting under my currently active role:

$ aws sts get-caller-identity
{
    "UserId": "AROA2MDGRZUIRD434HHAF:johndoe",
    "Account": "123456789012",
    "Arn": "arn:aws:sts::123456789012:assumed-role/myrole/johndoe"
}

I can assume another role from myrole as expected:

$ aws sts assume-role --role-arn arn:aws:iam::123456789012:role/otherRole --role-session-name mySession123
{
    "Credentials": {
        "AccessKeyId": "ASIA...",
        "SecretAccessKey": "...",
        "SessionToken": "...",
        "Expiration": "2021-04-28T16:29:55+00:00"
    },
    "AssumedRoleUser": {
        "AssumedRoleId": "AROA...:mySession123",
        "Arn": "arn:aws:sts::123456789012:assumed-role/otherRole/mySession123"
    }
}

Now I want to configure a CLI profile to use otherRole. I tried an entry like this:

[profile otherRole]
role_arn = arn:aws:iam::123456789012:role/otherRole

but this causes an error, because I have to specify either a credential_source or a source_profile.

From an EC2 instance with a service role I would set credential_source=Ec2InstanceMetadata but this doesn't work here. Setting source_profile to default also causes an error:

The source profile "default" must have credentials.

How can I create a CLI-profile within the AWS CloudShell to persistentely assume another role?

Looks like you may have to persist the credentials associated with your CloudShell identity to the default profile in `~/.aws/config` in order to be able to do this because credential_source doesn't appear to support this use case. — jarmod, Apr 28 '21 at 16:32
But what if I do not even have long-term credentials for my current identity (like using a role in a different account)? — mat, Apr 29 '21 at 06:21

score 3 · Accepted Answer · answered Apr 29 '21 at 12:47

I found the answer to be documented here. CloudShell ist not using EC2 instances but is rather running in an ECS based container. Thus setting the credential_source to EcsContainer does the trick:

[profile otherRole]
credential_source=EcsContainer
role_arn=arn:aws:iam::123456789012:role/otherRole

How can I create profiles in the AWS CloudShell to access different roles?

1 Answers1