Using an Assumed Role with AWS CLI
Published: 2023-09-04 03:57:33

## Configuring Default Profile

To communicate with your AWS Resources and different AWS APIs, AWS provides its CLI commands and you can do so much work using the commands. To use these commands you need to get the profiles set. So let’s do this!

To configure a default AWS profile for your CLI, AWS provides a very handy command.

You can set a default profile by running this command:

```bash
	aws configure
```

Terminal prompts for AWS Access Key, Secret Key, Region, and Output Format. Configuring a default profile is useful if you are going to use that profile frequently.

After running this and providing appropriate values, your `~/.aws/config` file will look like this:

```
[default]
region=ap-south-1
output=json
```

`~/.aws/credentials` file will look like below:

```
[default]
aws_access_key_id=YOUR_ACCESS_KEY
aws_secret_access_key=YOUR_SECRET_ACCESS_KEY
```

**Note:** In Windows, the AWS directory will be located in `C:/Users/<userid>/.aws`

## Configuring Named Profiles

AWS CLI can have multiple profiles so that you can switch between different profiles to work with different projects. You can add the profile name you want using the `—-profile` option.

For example, if you want to have a profile named `dev_account`, you can do that by running:

```bash
aws configure --profile dev_account
```

The same process would follow as configuring the default profile.

Great! You have configured a named profile for yourself🙌.

Now, your config file will look like this with multiple profiles configured:

```
[default]
region=ap-south-1
output=json
[profile dev_account]
region=us-east-1
output=json
```

and your credentials file will look like this:

```
[default]
aws_access_key_id=YOUR_ACCESS_KEY
aws_secret_access_key=YOUR_SECRET_ACCESS_KEY
[dev_account]
aws_access_key_id=YOUR_ACCESS_KEY
aws_secret_access_key=YOUR_SECRET_ACCESS_KEY
```

Get the list of profiles by running the following in the terminal:

```bash
aws configure list-profiles
```

It will display profiles with the name you added now. Cheers🚀.

## Configuring an IAM Role using CLI

You can also be having different roles having different permissions. So it is useful to configure them into CLI and to access the roles using commands.

For example, if you want a profile for a role named `dev_account_readonly`, you can do that by running:

```bash
aws configure --profile dev_account_readonly
```

The terminal prompts for the same configurations, but you can skip entering Access Key and Secret Access Key while creating a role profile, these credentials will be taken from the source profile we set ahead.
To set the required properties for the role profile, use the below commands and provide appropriate values:

```bash
aws configure set source_profile dev_account --profile dev_account_readonly
aws configure set role_arn ROLE_ARN --profile dev_account_readonly
aws configure set mfa_serial MFA_SERIAL_ARN --profile dev_account_readonly
```

Here, we set the source profile as the profile that has the permission to assume the role and IAM Role ARN. If the account is using Multi-Factor Authentication, then you also need to set the ARN of that MFA device.

After configuring the role your config file will be looking like this:

```
[default]
region=ap-south-1
output=json
[profile dev_account]
region=us-east-1
output=json
[profile dev_account_readonly]
region=us-east-1
output=json
source_profile=dev_account
role_arn=ROLE_ARN
mfa_serial=MFA_SERIAL_ARN
```

To verify if the role has been configured or not, you can do so by running below command:

```bash
aws iam get-role --role-name dev_account_readonly --profile dev_account_readonly
```

Replace the role and profile name with the names you set. All the information regarding the IAM Role will be returned in the JSON format.

That’s all you require for setting the profiles in your CLI and use the Assumed Role🎉!