aws/aws-cli — pull request #656 by garnaat (2014-02-18 01:31:54+00:00)
Title: WIP Commit.

This is not ready for prime time yet. Also, this depends on https://github.com/boto/botocore/pull/226.

I have session start/end working and also the launching of the web console with session credentials. Needs lots of cleanup and tests and support for federated and SAML credentials. I am using this at the moment with a lot of assumed roles using an IAM account in the ``dev`` environment that is authorized to assume certain roles in the ``prod`` environment. It's actually working pretty well and being able to launch the web console with the temporary credentials is really nice.

I don't like how you have to remember the ARN of the role you want to assume. It would be much nicer to be able to provide easy-to-remember names for roles in the config file. Perhaps something like:

[Roles]
myrole1 = *ARN of IAM Role*

Also, I'm still not 100% sold on the modal nature of this. You basically start a session via ``AssumeRole`` or some other mechanism and then everything you do with the CLI until you end the session is with those credentials. The alternative would be to allow for multiple named sessions and to require the user to specify a ``--session-name`` option to explicitly use a session for each command. That's kind of a pain and I think I like the ``start/end`` idea better but it can be kind of dangerous if you forget you started a session.