{"id":18866400,"url":"https://github.com/nordcloud/assume-role-arn","last_synced_at":"2025-04-14T14:31:10.132Z","repository":{"id":35178866,"uuid":"159239235","full_name":"nordcloud/assume-role-arn","owner":"nordcloud","description":"🤖🎩assume-role-arn allows you to easily assume an AWS IAM role in your CI/CD pipelines, without worrying about external dependencies.","archived":false,"fork":false,"pushed_at":"2024-03-11T09:50:35.000Z","size":83,"stargazers_count":55,"open_issues_count":5,"forks_count":8,"subscribers_count":23,"default_branch":"master","last_synced_at":"2025-03-28T03:25:04.709Z","etag":null,"topics":["aws","aws-iam","golang","pipeline"],"latest_commit_sha":null,"homepage":"","language":"Go","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":null,"status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/nordcloud.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":null,"code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null}},"created_at":"2018-11-26T22:06:11.000Z","updated_at":"2024-01-21T06:26:27.000Z","dependencies_parsed_at":"2024-06-20T05:54:21.836Z","dependency_job_id":"390ea061-0ced-499c-9d3e-fc2f71484041","html_url":"https://github.com/nordcloud/assume-role-arn","commit_stats":null,"previous_names":[],"tags_count":18,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nordcloud%2Fassume-role-arn","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nordcloud%2Fassume-role-arn/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nordcloud%2Fassume-role-arn/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nordcloud%2Fassume-role-arn/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/nordcloud","download_url":"https://codeload.github.com/nordcloud/assume-role-arn/tar.gz/refs/heads/master","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":248897085,"owners_count":21179534,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["aws","aws-iam","golang","pipeline"],"created_at":"2024-11-08T05:06:26.443Z","updated_at":"2025-04-14T14:31:09.828Z","avatar_url":"https://github.com/nordcloud.png","language":"Go","funding_links":[],"categories":[],"sub_categories":[],"readme":"# assume-role-arn\n\nassume-role-arn is a simple golang binary that can be used as an `aws --profile`\nalternative or in CI/CD pipelines, so you don't need any external dependencies\nwhile assuming cross-account roles from your environment. No need to install\npython/awscli and jq.\n\n### Main features\n* no need to setup awscli profiles\n* no dependencies, released as binary\n* ability to execute in-line commands\n* supports external id\n* supports source profile in shared credentials files\n* made with ❤️ in Nordcloud\n\n## Usage\n```\n$ eval $(assume-role-arn -r \u003crole_arn\u003e)\n$ aws sts get-caller-identity\n```\nor\n```\n$ assume-role-arn -r \u003crole_arn\u003e aws sts get-caller-identity\n```\n\nAvailable flags:\n\n*  `-r role_arn` - required, role ARN\n*  `-e external_id` - optional, if you need to specify external id\n*  `-n role_session_name` - probably you don't need this\n*  `-m mfa_serial` - optional, the ARN of MFA virtual device\n*  `-mfatoken token` - optional, the MFA token\n*  `-profile profile_name` - the name of AWS profile (from $HOME/.aws/config)\n*  `-ignoreCache` - ignore the credentials stored in the cache\n*  `-skipCache` - skip the credential cache\n*  `-envprefix` - add prefix to exported environmental variables (default: \"\")\n*  `-h` - help\n\n## CI/CD pipeline example\nLet's say we have three AWS accounts:\n* iam\n* stg\n* prod\n\nYou have your IAM deployment user only on `iam` account, but it can assume\ncross-account roles in `prod` and `stg` accounts.  Make sure you have your\n`AWS_ACCESS_KEY_ID` and `AWS_SECRET_ACCESS_KEY` exported in your pipeline's env\nvariables.\n\nGo to [Releases](https://github.com/nordcloud/assume-role-arn/releases) and\nselect binary from the last release you want to use. For v0.2 and linux it would\nbe\nhttps://github.com/nordcloud/assume-role-arn/releases/download/v0.2/assume-role-arn-linux\n\nAdd following steps in the beginning of your deployment script:\n```\ncurl https://github.com/nordcloud/assume-role-arn/releases/download/v0.2/assume-role-arn-linux -o /usr/local/bin/assume-role-arn\nchmod +x /usr/local/bin/assume-role-arn\n\neval $(assume-role-arn -r arn:aws:iam::ACCOUNT_NUMBER_STG:role/Deployment)\n```\n\n*Please adjust output path of curl command and role ARN according to your needs.*\n\nNow you should be able to execute AWS-related commands with your assumed role.\n\n## MFA\n\nIf your account is secured with MFA (multi-factor authentication) then you have\nto provide the ARN of MFA device and the token:\n```\neval $(assume-role-arn -r arn:aws:iam:ACCOUNT_NUMBER_STG:role/Role -m arn:aws:iam::ACCOUNT:mfa/MFA_ID -mfatoken MFATOKEN)\n```\n\n## AWS Profile\n\nYou can put the role name, external id, and the mfa serial device to the profile\nin\n[`$HOME/.aws/config`](https://docs.aws.amazon.com/cli/latest/userguide/cli-configure-profiles.html)\n\n```ini\n[profile Dev]\nrole_arn = arn:aws:iam::123456789:role/Role\nsource_profile = dev\nregion = eu-west-1\nmfa_serial = arn:aws:iam::987654321:mfa/john.lenon@world.com\n```\n\nwith that defined profile, you can run any command that required AWS credentials\n(even with MFA) by running\n```shell script\nassume-role-arn-linux -profile Dev aws s3 ls\n```\n\n## powerlevel10k prompt\nThe binary outputs credentials origins as environment variables:\n\n- AWS_PROFILE_NAME\n- AWS_ACCOUNT_ID\n- AWS_ROLE_NAME\n\nWhich can be used to build custom prompt for p10k.\n\n\nPut below code in `~/.p10k.zsh` file.\n\n```sh\nfunction prompt_assume_role_arn() {\n    if [[ -n $AWS_PROFILE_NAME ]]; then\n        local display_text=$AWS_PROFILE_NAME\n    elif [[ -n $AWS_ACCOUNT_ID \u0026\u0026 -n $AWS_ROLE_NAME ]]; then\n        local display_text=\"$AWS_ACCOUNT_ID ($AWS_ROLE_NAME)\"\n    fi\n\n    [[ -n $display_text ]] || return\n\n    p10k segment -i '' -t $display_text\n}\n```\n\nNow you can reference your custom promp in config:\n```sh\n  typeset -g POWERLEVEL9K_RIGHT_PROMPT_ELEMENTS=(\n      status\n      command_execution_time\n      ...\n      assume_role_arn\n      ...\n      time\n  )\n```\n\nTo style it use [powerlevel variables](https://github.com/romkatv/powerlevel10k/blob/master/internal/p10k.zsh#L6741)\n\nExample screenshot\n![p10k prompt example](screenshots/p10k-prompt-example.png \"p10k prompt example\")\n\n\n## Authors\n* Jakub Woźniak, Nordcloud 🇵🇱\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fnordcloud%2Fassume-role-arn","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fnordcloud%2Fassume-role-arn","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fnordcloud%2Fassume-role-arn/lists"}