4 ms·
Using multiple profiles with AWS-CLI
- paranoidrobot 4y agoMultiple profiles is good practice. However I'd suggest two things. Use roles to assume access into other accounts across your AWS Organisation. So, instead of what the article says, try: [default] aws_access_key_id = XXXXXX aws_secret_access_key = XXXXXX [staging] source_profile = default assume_role = arn:aws:iam::your-staging-aws-account:role/dev-staging-role [production] source_profile = default assume_role = arn:aws:iam::your-prod-aws-account:role/dev-prod-role This reduces the number of IAM keys you need to manage and worry about rotating. The IAM key for default should only have permissions to assume into other roles. The second suggestion is to look at using AWS SSO (now called AWS Identity Center[1]). This replaces long-lived keys on your machine, and instead you authenticate through AWS SSO to get a set of temporary keys. You can tie AWS SSO back to require you to authenticate through GSuite or another SAML Identity Provider if you like, or use their built-in IDP. [1] https://aws.amazon.com/iam/identity-center/ https://aws.amazon.com/iam/identity-center/