0

I have a bash script that assumes an IAM role and then pass the credentials to the next command:

#!/bin/bash
sudo su <<EOF

aws sts assume-role --role-arn "arn:aws:iam::0123456789:role/SomeRole" --role-session-name AWSCLI-Session > /awsCredential

awscurl https://someApi --request POST --region us-west-2 --access_key $(cat /awsCredential | jq -r '.Credentials.AccessKeyId')

EOF

When running the script, $(cat /awsCredential | jq -r '.Credentials.AccessKeyId') resolved to empty, but if I run the above commands manually from terminal, I can see it resolves to the AWS ACCESS KEY ID returned from the assume role command, does anyone know why is that?

Yamazaki
  • 3
  • 2
  • Which variable would that be? I don't see any variables in your script. – tink Oct 16 '22 at 23:10
  • 1
    The `cat` command is being executed by the original user, not the root. Do you have read permission to the file? – Barmar Oct 16 '22 at 23:15
  • 1
    Use `<<'EOF'` so that the command substitution will not be executed when the here-doc is expanded, it will be executed by the superuser shell. – Barmar Oct 16 '22 at 23:17

0 Answers0