AWS assume role one-liner

 A couple of months ago, I wanted to simplify the way I assume a role in AWS, an operation I perform several times a day. Usually, you would run a command like this one with the AWS CLI:

aws sts assume-role --role-arn $MY_ROLE_ARN --role-session-name test

It would return you a JSON document like this one:

{

    "AssumedRoleUser": {

        "AssumedRoleId": "AROA3XFRBF535PLBIFPI4:s3-access-example",

        "Arn": "arn:aws:sts::123456789012:assumed-role/xaccounts3access/s3-access-example"

    },

    "Credentials": {

        "SecretAccessKey": "9drTJvcXLB89EXAMPLELB8923FB892xMFI",

        "SessionToken": "AQoXdzELDDY//////////wEaoAK1wvxJY12r2IrDFT2IvAzTCn3zHoZ7YNtpiQLF0MqZye/qwjzP2iEXAMPLEbw/m3hsj8VBTkPORGvr9jM5sgP+w9IZWZnU+LWhmg+a5fDi2oTGUYcdg9uexQ4mtCHIHfi4citgqZTgco40Yqr4lIlo4V2b2Dyauk0eYFNebHtYlFVgAUj+7Indz3LU0aTWk1WKIjHmmMCIoTkyYp/k7kUG7moeEYKSitwQIi6Gjn+nyzM+PtoA3685ixzv0R7i5rjQi0YE0lf1oeie3bDiNHncmzosRM6SFiPzSvp6h/32xQuZsjcypmwsPSDtTPYcs0+YN/8BRi2/IcrxSpnWEXAMPLEXSDFTAQAM6Dl9zR0tXoybnlrZIwMLlMi1Kcgo5OytwU=",

        "Expiration": "2016-03-15T00:05:07Z",

        "AccessKeyId": "ASIAJEXAMPLEXEG2JICEA"

    }

}

And then you would need to export environment variables for setting the access key, secret key and session token.

export AWS_ACCESS_KEY_ID="ASIAJEXAMPLEXEG2JICEA"
export AWS_SECRET_ACCESS_KEY="9drTJvcXLB89EXAMPLELB8923FB892xMFI"
export AWS_SESSION_TOKEN="..."

So I looked for a simpler solution and I stumbled upon this StackOverfow question: AWS sts assume role in one command. 

Some suggestions use the very useful JQ utility which allows to retrieve information from JSON documents. But in case of AWS CLI commands, it is normally not necessary, since they all accept the --query option that supports JMESPath syntax. So, as one answer suggested, you can simply use the join built-in command to construct your export command, and let the shell evaluate it. Which is the solution I used for some months now:

eval $(aws sts assume-role \

 --role-arn $MY_ROLE_ARN \

 --role-session-name test \

 --query 'join(``, [`export AWS_ACCESS_KEY_ID=`,

 Credentials.AccessKeyId, ` ; export AWS_SECRET_ACCESS_KEY=`,

 Credentials.SecretAccessKey, `; export AWS_SESSION_TOKEN=`,

 Credentials.SessionToken])' \

 --output text)

This command has been really practical, so I decided to add an entry to my blog about it, so I will always remember where to look for it. So I returned to the StackOverflow site, and I found out that a simpler solution was suggested since. It uses the built-in printf shell function, that I had absolutely no idea existed:

export $(printf "AWS_ACCESS_KEY_ID=%s AWS_SECRET_ACCESS_KEY=%s AWS_SESSION_TOKEN=%s" \

$(aws sts assume-role \

--role-arn $MY_ROLE_ARN \

--role-session-name test \

--query "Credentials.[AccessKeyId,SecretAccessKey,SessionToken]" \

--output text))

I guess you never stop learning.