# AWS credentials not working with cross account role

**URL:** <https://forum.ansible.com/t/aws-credentials-not-working-with-cross-account-role/26800>\
**Category:** Ansible Project\
**Tags:** aws\
**Created:** [February 20, 2018, 10:08am UTC](https://forum.ansible.com/t/aws-credentials-not-working-with-cross-account-role/26800 "2018-02-20T10:08:27Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![Craig\_Wilson](https://avatars.discourse-cdn.com/v4/letter/c/eb9ed0/32.png) [@Craig\_Wilson](https://forum.ansible.com/u/Craig_Wilson)\
**Post date:** [February 20, 2018, 10:08am UTC](https://forum.ansible.com/t/aws-credentials-not-working-with-cross-account-role/26800/1 "2018-02-20T10:08:27Z")

</div>

Hello

I’ve been trying to get my team at work to adopt better credential management but I’m struggling to get ansible working with the aws cli credentials file. My credentials file seems to work just fine with aws cli and directly using boto in a python script but not in ansible. My file is setup as below

`

# credentials

[default]  
aws\_access\_key\_id=PARENTKEY  
aws\_secret\_access\_key=PARENTSECRETKEY

[childprofile]  
role\_arn=arn:aws:iam::########:role/groupname  
source\_profile=default

`

but when I execute the playbook I just get

`

“msg”: “Profile given for AWS was not found. Please fix and retry.”

`

I know that the profile name is being correctly as this is shown in the verbose output

`

EXEC /bin/sh -c ‘AWS\_PROFILE=childprofile /usr/bin/python /home/user/.ansible/tmp/ansible-tmp-1519121014.43-259509127929346/ec2\_vpc\_net.py; rm -rf “/home/user/.ansible/tmp/ansible-tmp-1519121014.43-259509127929346/” \> /dev/null 2\>&1 && sleep 0’

`

and I know that the credentials file works because if I replace the role and the source\_profile with aws\_access\_key and aws\_secret\_access\_key it works.

I’ve been looking at this for a few days and can’t figure it out.

---

<div class="post-metadata">

**Author:** ![Craig\_Wilson](https://avatars.discourse-cdn.com/v4/letter/c/eb9ed0/32.png) [@Craig\_Wilson](https://forum.ansible.com/u/Craig_Wilson)\
**Post date:** [February 20, 2018, 11:06am UTC](https://forum.ansible.com/t/aws-credentials-not-working-with-cross-account-role/26800/2 "2018-02-20T11:06:29Z")

</div>

I have managed to get it working by setting the assume role values for ansible modules and then setting the AWS\_PROFILE env variable for the shell commands, at least it seems to work fine.

Credentials file:

`

# credentials

[default]  
region=us-west-2  
aws\_access\_key\_id=PARENTACCOUNTKEY  
aws\_secret\_access\_key=PARENTSECRETKEY

[childprofile]  
role\_arn=arn:aws:iam::ACCOUNTNUMBER:role/ROLENAME  
source\_profile=default

`

Playbook:  
`  
pre\_tasks:

- sts\_assume\_role:  
role\_arn: “arn:aws:iam::ACCOUNTNUMBER:role/ROLENAME”  
role\_session\_name: “someRoleSession”  
region: ‘eu-west-1’  
profile: “default”  
register: assumed\_role

environment:

AWS\_ACCESS\_KEY: “{{ assumed\_role.sts\_creds.access\_key }}”  
AWS\_SECRET\_KEY: “{{ assumed\_role.sts\_creds.secret\_key }}”  
AWS\_SECURITY\_TOKEN: “{{ assumed\_role.sts\_creds.session\_token }}”  
AWS\_PROFILE: ‘childprofile’  
AWS\_DEFAULT\_REGION: ‘{{ aws\_region }}’  
`