boto / botocore

29%

develop: 97%

LAST BUILD ON BRANCH add_recursive_role_assumption

branch: SELECT

CHANGE BRANCH

x

• No branch selected
• 0.100.0
• 0.101.0
• 0.102.0
• 0.103.0
• 0.104.0
• 0.105.0
• 0.106.0
• 0.107.0
• 0.108.0
• 0.109.0
• 0.56.0
• 0.62.0
• 0.63.0
• 0.64.0
• 0.65.0
• 0.66.0
• 0.68.0
• 0.69.0
• 0.70.0
• 0.73.0
• 0.75.0
• 0.76.0
• 0.77.0
• 0.78.0
• 0.80.0
• 0.81.0
• 0.82.0
• 0.83.0
• 0.84.0
• 0.85.0
• 0.86.0
• 0.88.0
• 0.89.0
• 0.90.0
• 0.91.0
• 0.92.0
• 0.93.0
• 0.94.0
• 0.95.0
• 0.96.0
• 0.97.0
• 0.98.0
• 0.99.0
• 1.0.0a1
• 1.0.0a2
• 1.0.0a3
• 1.0.0b1
• 1.4.10
• 1.4.11
• 1.4.12
• 1.4.13
• 1.4.14
• 1.4.15
• 1.4.16
• 1.4.17
• 1.4.18
• 1.4.19
• 1.4.20
• 1.4.21
• 1.4.22
• 1.4.23
• 1.4.24
• 1.4.25
• 1.4.26
• 1.4.27
• 1.4.28
• 1.4.3
• 1.4.4
• 1.4.5
• 1.4.6
• 1.4.7
• 1.4.8
• 1.4.9
• anon-clients
• clients-only
• develop
• master
• test-branch

Add recursive role assumption.

This change will allow a profile to use a profile that uses a role as a
source profile. This will allow hierarchies of profiles where a user is
used to assume a role which is then used to assume another role. This is
useful for when another account grants cross account access and the role
that can assume the other role is assumable by users. Here's an example.

~/.aws/credentials:
[default]
aws_access_key_id = <blah_id>
aws_secreet_access_key = <blah_secret>

~/.aws/config
[profile customer_accessor_role]
role_arn=arn:aws:iam:<my_acct_number>:role/customer_accessor_role
source_profile=default

[profile customer_role]
role_arn=arn:aws:iam:<customer_acct_number>:role/customer_role
source_profile=customer_accessor_role
external_id=<whatever>

Now I can do things like the following:
aws --profile customer_role s3 ls