Configure an automatic assume-role CLI profile

Part 117 of AWS from Zero. This lesson changes or inspects one IAM concept so the permission model stays understandable.

What we are learning

A role profile lets the AWS CLI call STS on demand using credentials from a source profile.

Before you run it

ACCOUNT_ID=$(aws sts get-caller-identity --query Account --output text)
ROLE_ARN="arn:aws:iam::$ACCOUNT_ID:role/aws-zero-demo-role"
ROLE_PROFILE="aws-zero-role"
SOURCE_PROFILE="default"

The source profile must be able to assume the target role.

The command

aws configure set profile.$ROLE_PROFILE.role_arn "$ROLE_ARN"
aws configure set profile.$ROLE_PROFILE.source_profile "$SOURCE_PROFILE"
aws configure set profile.$ROLE_PROFILE.role_session_name "aws-zero-profile"

These values are written to the shared AWS CLI config file.

Inspect the result

aws sts get-caller-identity \
  --profile "$ROLE_PROFILE" \
  --query "{Arn:Arn,Account:Account}" \
  --output table

Read the returned ARN, path, IDs, and attachment state instead of checking only the command exit code.

One tiny variation

AWS_PROFILE="$ROLE_PROFILE" aws s3api list-buckets \
  --query "Buckets[].Name" \
  --output text

Set AWS_PROFILE for one command without changing the default profile globally.

Common mistake

Do not create circular source-profile chains. Keep profile names, account IDs, and role ARNs explicit.

Cleanup

aws configure set profile.$ROLE_PROFILE.role_arn ""
aws configure set profile.$ROLE_PROFILE.source_profile ""
aws configure set profile.$ROLE_PROFILE.role_session_name ""

The CLI has no delete-profile command; remove empty profile sections from the config file if necessary.

Next, we will learn Name and limit an STS role session.

Official AWS CLI reference