# AWX Credential Type for AWS IAM Roles

**URL:** <https://forum.ansible.com/t/awx-credential-type-for-aws-iam-roles/6716>\
**Category:** Project Discussions\
**Tags:** aws, awx, ee\
**Created:** [June 21, 2024, 10:22pm UTC](https://forum.ansible.com/t/awx-credential-type-for-aws-iam-roles/6716 "2024-06-21T22:22:59Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![derekwaters](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/derekwaters/32/275_2.png) [@derekwaters](https://forum.ansible.com/u/derekwaters)\
**Post date:** [June 21, 2024, 10:22pm UTC](https://forum.ansible.com/t/awx-credential-type-for-aws-iam-roles/6716/1 "2024-06-21T22:22:59Z")

</div>

As a proof of concept, I did some work for a client to build a custom credential lookup plugin that allows you to use AWS IAM Role Assumption when automating AWS targets. The Credential Lookup uses either the default execution environment AWS creds, or provided creds, then uses the AWS AssumeRole API to assume another AWS IAM Role, then returns the temporarily assumed credentials for use in the actual execution job.

Effectively, this means you don’t have to store long-lived credentials for an AWS account with wide-ranging permissions over a large AWS estate.

Is there any interest in me tidying this up and contributing it to the AWX project?

---

<div class="post-metadata">

**Author:** ![shrutebattlestargala](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/shrutebattlestargala/32/2029_2.png) [@shrutebattlestargala](https://forum.ansible.com/u/shrutebattlestargala)\
**Post date:** [June 22, 2024, 10:56am UTC](https://forum.ansible.com/t/awx-credential-type-for-aws-iam-roles/6716/2 "2024-06-22T10:56:06Z")

</div>

Yes please! And thank you!

---

<div class="post-metadata">

**Author:** ![davdunc](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/davdunc/32/626_2.png) [@davdunc](https://forum.ansible.com/u/davdunc)\
**Post date:** [June 25, 2024, 9:35pm UTC](https://forum.ansible.com/t/awx-credential-type-for-aws-iam-roles/6716/3 "2024-06-25T21:35:51Z")

</div>

+1 over here. I cannot use hard-coded credentials due to policy restrictions. This is a huge help.

---

<div class="post-metadata">

**Author:** ![derekwaters](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/derekwaters/32/275_2.png) [@derekwaters](https://forum.ansible.com/u/derekwaters)\
**Post date:** [August 22, 2024, 7:40am UTC](https://forum.ansible.com/t/awx-credential-type-for-aws-iam-roles/6716/4 "2024-08-22T07:40:54Z")

</div>

A very belated update. There is a PR in progress on this:

> <https://github.com/ansible/awx/pull/15294>
>
> \##### SUMMARY
> This change adds a new credential plugin that allows for the look…up of temporary AWS credentials using the AWS AssumeRole API. An AWS User Account may be configured either in the AssumeRole credential plugin (with an Access Key and Secret Key) or the default AWS API authentication may be used within the execution environment.
> 
> Prior to execution a job, the AWS AssumeRole API is called with the specified role name (ARN). If the authentication is successful, a temporary Access Key, Secret Key and Session Token are generated by AWS and used to populate a standard AWS Access Credential.
> 
> \##### ISSUE TYPE
> - New or Enhanced Feature
> 
> \##### COMPONENT NAME
> - API
> 
> \##### AWX VERSION
> \`\`\`
> awx: 0.1.dev34063+g5b9e03a
> \`\`\`
> 
> 
> \##### ADDITIONAL INFORMATION
> AWS AssumeRole API information can be found here:
> 
> https://docs.aws.amazon.com/cli/latest/reference/sts/assume-role.html#output
> 
> Details of how this plugin works (from when it was implemented as a custom user-installed plugin) can be found here:
> 
> https://derekwaters.github.io/ansible/execution/environments/credentials/aws/sts/assume/role/2023/12/21/building-a-custom-credential-plugin.html