{"id":22327504,"url":"https://github.com/rewindio/aws-role-play","last_synced_at":"2025-07-29T18:31:09.591Z","repository":{"id":42206772,"uuid":"382374215","full_name":"rewindio/aws-role-play","owner":"rewindio","description":"A CLI tool that makes assuming IAM roles and exporting temporary credentials easier","archived":false,"fork":false,"pushed_at":"2023-01-12T00:04:15.000Z","size":51,"stargazers_count":0,"open_issues_count":0,"forks_count":1,"subscribers_count":11,"default_branch":"main","last_synced_at":"2023-03-02T22:56:11.502Z","etag":null,"topics":["aws","cli","iam","mfa","security","sts"],"latest_commit_sha":null,"homepage":"","language":"Python","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"mit","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/rewindio.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":".github/CODEOWNERS","security":null,"support":null}},"created_at":"2021-07-02T14:38:00.000Z","updated_at":"2021-12-15T15:09:58.000Z","dependencies_parsed_at":"2023-02-09T09:00:40.731Z","dependency_job_id":null,"html_url":"https://github.com/rewindio/aws-role-play","commit_stats":null,"previous_names":[],"tags_count":null,"template":null,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/rewindio%2Faws-role-play","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/rewindio%2Faws-role-play/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/rewindio%2Faws-role-play/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/rewindio%2Faws-role-play/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/rewindio","download_url":"https://codeload.github.com/rewindio/aws-role-play/tar.gz/refs/heads/main","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":228034988,"owners_count":17859245,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["aws","cli","iam","mfa","security","sts"],"created_at":"2024-12-04T03:09:38.244Z","updated_at":"2024-12-04T03:09:39.081Z","avatar_url":"https://github.com/rewindio.png","language":"Python","funding_links":[],"categories":[],"sub_categories":[],"readme":"# aws-role-play\n\n## Motivation\n\nStoring unencrypted credentials in `~/.aws/credentials` can be risky, but is often the simplest way to setup access to AWS. If the computer is compromised, a bad actor could gain access to the AWS account. If a user is required to assume a role that requires MFA, the security risk is reduced.\n\nAWS CLI supports role assumption by [caching temporary credentials](https://docs.aws.amazon.com/cli/latest/userguide/cli-configure-role.html), but unfortunately does not export the temporary credentials to locations where other external applications are expecting them.\n\n`aws-role-play` makes it easier to write and export these temporary credentials. Assuming roles eliminates the need to store and transmit privileged long-term access keys. This tool re-uses the same credentials cache as AWS CLI, and then either exports the credentials to the current shell, or puts the credentials in `~/.aws/credentials` (or `AWS_SHARED_CREDENTIALS_FILE`) so that external applications can read the credentials.\n\nFor more information on current issues:\n\n- https://github.com/hashicorp/terraform-provider-aws/issues/10491\n- https://github.com/aws/aws-cli/issues/4676\n\n## Installation\n\nThere are multiple methods of installation:\n\n### brew\n\nRequires [brew](https://brew.sh).\n\n```sh\nbrew install rewindio/public/aws-role-play\n```\n\n### pipx\n\nRequires [pipx](https://github.com/pypa/pipx).\n\n```sh\npipx install --user git+https://github.com/rewindio/aws-role-play\n```\n\n## Configuration\n\nConfiguration is read from `~/.aws/config`. Check out the [docs](https://docs.aws.amazon.com/cli/latest/userguide/cli-configure-files.html) to learn more about how it's configured.\n\n### Example\n\n```\n[foo]\nregion = ca-central-1\n\n[profile foo-admin]\nduration_seconds = 3600\nmfa_serial = arn:aws:iam::555555555555:mfa/myuser\nrole_arn = arn:aws:iam::555555555555:role/admin\nsource_profile = foo\n\n[profile foo-readonly]\nduration_seconds = 28800\nmfa_serial = arn:aws:iam::555555555555:mfa/myuser\nrole_arn = arn:aws:iam::555555555555:role/read-only\nsource_profile = foo\n```\n\nHaving a `mfa_serial` is optional, but it's good practice that a policy requires one.\n\n## Usage\n\n```sh\nUsage: aws-role-play [OPTIONS] COMMAND [ARGS]...\n\n  A CLI tool that makes assuming IAM roles easier\n\nOptions:\n  -v, --version\n  --help         Show this message and exit.\n\nCommands:\n  assume  Assumes a role and updates session credentials\n  list    List all roles defined in the aws config\n```\n\n### Exporting Credentials\n\nTo export the temporary credentials to the current shell:\n\n```sh\neval $(aws-role-play assume --profile foo-admin --export)\n```\n\nThis can be useful in circumstances where you want to run commands within the scope of the temporary credentials, as it will overwrite your environment variables (AWS_PROFILE, AWS_SECRET_ACCESS_KEY, AWS_ACCESS_KEY_ID, AWS_SESSION_TOKEN).  \nTherefore, try this if you see a program looking for these sorts of environment variables.\n\nExample errors include:\n * InvalidClientTokenId - The security token included in the request is invalid.\n\n### Writing Credentials\n\n\u003e Note: Temporary credentials will overwrite any existing credentials in the profile provided\n\nBased on the above configuration, to assume the admin role and update your credentials:\n\n```sh\naws-role-play assume --profile foo-admin --write\n```\n\nAfter assuming a role, check your identity by:\n\n### Checking Identity\n\n```sh\naws sts get-caller-identity --profile foo-admin\n```\n\n## Additional Resources\n\n- [aws-vault](https://github.com/99designs/aws-vault) provides a secure way to store and access credentials.\n\n- [leapp](https://github.com/Noovolari/leapp) also provides a secure way to store and access cloud credentials (with a GUI).\n\n- [aws-extend-switch-roles](https://github.com/tilfinltd/aws-extend-switch-roles) is a set of browser extensions for switching roles based on aws config.\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Frewindio%2Faws-role-play","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Frewindio%2Faws-role-play","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Frewindio%2Faws-role-play/lists"}