Cross-account access with aws-cli
In the previous post I explained how to Use Cross-account access through AWS Console. Today I’ll show you how to do the same in the command line using aws-cli.
We’ve got Access and Secret keys for the Login account and want to use
aws-cli to create and manage resources in the Dev account above.
Configure aws-nz-login credentials
First step is to configure
with credentials for the aws-nz-login account
~ $ aws configure
AWS Access Key ID [None]: AKIABCDEFGHJKLMNOPQR
AWS Secret Access Key [None]: ZxCvBnMaSdFgHjKlQwErTyUiOp
Rename default profile to aws-nz-login
. I tend to rename [default]
so that I don’t inadvertently issue actions against a wrong account. Without [default]
profile I always have to specify
which makes me think twice if I use the right account.
~ $ cat .aws/credentials
# These are aws-nz-login account credentials
aws_access_key_id = AKIABCDEFGHJKLMNOPQR
aws_secret_access_key = ZxCvBnMaSdFgHjKlQwErTyUiOp
in your favourite text editor and add a new
profile at the end.
role_arn = arn:aws:iam::123456789012:role/Admin
source_profile = aws-nz-login # <-- reference to Login account
The number 123456789012 is the AWS Account ID of aws-nz-dev.
To use the new profile with aws-cli
use the parameter
~ $ aws --profile aws-nz-dev sts get-caller-identity
As we can see the Account ID is 123456789012 which is the Dev account number, yay!
From now on you can use
aws --profile aws-nz-dev every time you you want to work in the Dev account.
If you always
want to work in the
profile you have two options:
- Rename it to
$AWS_DEFAULT_PROFILE=customer-project in your shell.
~ $ export AWS_DEFAULT_PROFILE=customer-project
~ $ aws sts get-caller-identity
... will be the same output as above, even without specifying --profile ...
If you have a shell script that makes a lot of these cross-account aws-cli calls you may notice it runs quite slow. That's because each call has to fetch a new set of cross-account credentials and that takes a second or so. In the next post I'll show you a faster way to do that.
Share This Story, Choose Your Platform!
Leave A Comment