Package: iam-sudo
NAMEiam-sudo - get credentials of a real or simulated IAM roleUsageUsage: iam-sudo assume [OPTIONS] [CMD]...

Options:
--role-name NAME   to assume  [required]
--profile PROFILE  to save the credentials underUsage: iam-sudo simulate [OPTIONS] [CMD]...

Options:
  --role-name NAME       to simulate  [required]
  --principal PRINCIPAL  of the simulated role
  --base-role NAME       to assume to simulate the role
  --remote / --local     invoke lambda, default --remote
  --profile PROFILE      to save the credentials underDESCRIPTIONiam-sudo supports theassumeand thesimulatecommands.assume commandthis command will assume the specified role and return the credentials.If aprofileis specified, the credentials will be stored in~/.aws/credentials.If a command is specified, it will be executed with the obtained credentials. This is done
by setting the environment variablesAWS_ACCESS_KEY_ID,AWS_SECRET_ACCESS_KEYandAWS_SESSION_TOKEN.simulate commandiam-sudo simulate will read the attached policies and inline policies of the specifiedrole-name.
These policies will be used to create the session policy. Thebase-roleis the
role that will be assumed combined with the session policy, to mimic the specified role.role-nameis a substring of the role to assume. This is to make it easier to assume a
role that was created by AWS CloudFormation. For instance, bothTaskRolesandmy-stack-TaskRolemay resolve to the rolemy-stack-TaskRole-9AO01PCC7I0T.If multiple matching roles are found, an error is returned. You may also specify
theprincipalto reduce the number of matching roles: for
instance--principal Service:ecs-tasks.amazonaws.com.If aprofileis specified, the credentials will be stored in~/.aws/credentials.If a command is specified, it will be executed with the obtained credentials. This is done
by setting the environment variablesAWS_ACCESS_KEY_ID,AWS_SECRET_ACCESS_KEYandAWS_SESSION_TOKEN.Theremoteflag wil invoke the iam-sudo Lambda function to generate credentials. This
remote option, is required to really give users sudo-like permissions which exceeds
their own. Without theremoteflag, the user will not be able to get more
permissions, than granted to him/her.Sudo simulated PolicyTo limit the roles which can be simulated, a policy can be specified. The following
snippet shows the default sudo policy:allowed-role-names:-"*"allowed-principals:-"*":"*"allowed-base-roles:-"arn:aws:iam::*:role/*"The following table shows a short description of the fields.fielddescriptionallowed-role-namesa list of glob patterns specifying allowed role namesallowed-principalsa list of glob patterns specifying principal type and identityallowed-base-rolea list of glob patterns specifying allowed base rolesThe default client policy is to allow all role names, all principals and all base
roles to be specified.The following policy, restricts requests to any AWS ECS task role and the base
role to the IAmSudoUser.allowed-role-names:-"*"allowed-principals:-"Service":"ecs-tasks.amazonaws.com"allowed-base-roles:-"arn:aws:iam::123456789012:role/IAMSudoUser"installationThe installation comes in two parts: the client and the server.To install the client, type:pipinstalliam-sudoTo install the server, type:aws cloudformation create-stack \
     --stack-name iam-sudo \
    --template-url  https://binxio-public-eu-central-1.s3.amazonaws.com/lambdas/iam-sudo-0.2.0.yaml \
    --capabilities CAPABILITY_NAMED_IAM
aws cloudformation wait stack-create-complete --stack-name iam-sudoAlternatively, you can create the stack via
theAWS console.To allow users to use the remote function, they should be granted permission to
invoke the created Lambda functioniam-sudo.ENVIRONMENT VARIABLESThe iam-sudo simulate allows following environment variables to be set:namedescriptionIAM_SUDO_BASE_ROLEThe role to assume over which the session policies are added, defaultIAMSudoUserIAM_SUDO_POLICYThe policy which governs which roles can be assumed, default anyThe lambda function requires you to set both.Read the blogHow to assume an ECS task role in AWS, the official and the fake way.