aws/aws-cli — pull request #667 by bradleybluebean (2014-02-23 00:02:51+00:00)
Title: Add ability to use role ARN as configuration variable

My group at work needs to access a number of AWS accounts so we setup cross-account roles (http://docs.aws.amazon.com/IAM/latest/UserGuide/cross-acct-access.html) to allow us to use our existing IAM user accounts instead of creating IAM users in each AWS account. To simplify accessing these roles, I have added a configuration variable named role_arn to aws-cli. This can be used in a profile in place of access key ids and secrets. When a profile that is configured with a role_arn is invoked by the CLI, the access key id and secret from the default profile will be used to retrieve temporary security credentials for the role from STS and then the requested CLI command will be performed with said credentials.

The one thing about how this works that feels a little "dirty" to me is that new temporary credentials are retrieved each time the CLI is run with a role_arn profile, even if valid credentials already exist for the profile. I am fairly new to the AWS API and this is my first real attempt at Python programming so there might be a better way to handle that but I didn't see anything that appeared to address the situation when I looked at the STS documentation. One alternative would be to store the temporary credentials to a file but that seemed like a departure from how any other part of aws-cli works.

Thanks for your time. I appreciate any feedback you have about this addition and its implementation.