# Multiple AWS accounts and STS assume\_role support

**URL:** <https://forum.ansible.com/t/multiple-aws-accounts-and-sts-assume-role-support/17131>\
**Category:** Ansible Project\
**Tags:** aws\
**Created:** [December 23, 2014, 1:02am UTC](https://forum.ansible.com/t/multiple-aws-accounts-and-sts-assume-role-support/17131 "2014-12-23T01:02:59Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![Boris1](https://avatars.discourse-cdn.com/v4/letter/b/e9a140/32.png) [@Boris1](https://forum.ansible.com/u/Boris1)\
**Post date:** [December 23, 2014, 1:02am UTC](https://forum.ansible.com/t/multiple-aws-accounts-and-sts-assume-role-support/17131/1 "2014-12-23T01:02:59Z")

</div>

Hi,  
Not sure if this question belongs here or on the ansible\_development list, but let me start here.

Do Ansible AWS modules support [STS.assume\_role](http://boto.readthedocs.org/en/latest/ref/sts.html) to obtain temporary credentials and use them to sign API requests for multiple accounts?

Use case:

- pre-condition: multiple AWS accounts have a role with trust relationship with instance hosting Ansible
- Invoke ec2, ec2\_ami, rds, s3 or any other AWS cloud Ansible module targeting resources in multiple AWS accounts (using temporary credentials obtained from STS assume\_role for each account)

For example, snapshot all the volumes for all the instances tagged with ‘prod’ in all of my AWS accounts (using trust relationships and not using a bunch of AWS credentials laying around file system)

with straight boto this would look something like this:

> import boto
> 
> stsConn = boto.connect\_sts()
> 
> for (account in accounts):
> 
> role = stsConn.assume\_role(‘arn:aws:iam::%s:role/MyRole’ % account, ‘mySession’)
> 
> ec2conn = boto.connect\_ec2(aws\_access\_key\_id=role.credentials.access\_key, aws\_secret\_access\_key=role.credentials.secret\_key, security\_token=role.credentials.session\_token)
> 
> #ec2conn.do\_something()
> 
> s3conn = boto.connect\_s3(aws\_access\_key\_id=role.credentials.access\_key, aws\_secret\_access\_key=role.credentials.secret\_key, security\_token=role.credentials.session\_token)
> 
> #s3conn.do\_something()
> 
> ## etc for other AWS resources

Basically, is it possible to insert “assume\_role” before a module calls “connect”, and do it for multiple accounts?

Thanks in advance,  
-Boris

---

<div class="post-metadata">

**Author:** ![Boris1](https://avatars.discourse-cdn.com/v4/letter/b/e9a140/32.png) [@Boris1](https://forum.ansible.com/u/Boris1)\
**Post date:** [December 23, 2014, 4:19pm UTC](https://forum.ansible.com/t/multiple-aws-accounts-and-sts-assume-role-support/17131/2 "2014-12-23T16:19:05Z")

</div>

Here is my “solution” at the moment. Hoping to find something more elegant…

tasks:

- shell: aws sts assume-role --role-arn “arn:aws:iam::XXXXXXXXXXXX:role/myRole” --role-session-name mySession

register: role

- set\_fact:  
accessKeyId: “{{ (role.stdout | from\_json).Credentials.AccessKeyId }}”  
secretAccessKey: “{{ (role.stdout | from\_json).Credentials.SecretAccessKey }}”  
sessionToken: “{{ (role.stdout | from\_json).Credentials.SessionToken }}”

- ec2\_tag: resource=i-XXXXXXXX region=us-west-1 state=present  
args:  
aws\_access\_key: “{{ accessKeyId }}”  
aws\_secret\_key: “{{ secretAccessKey }}”  
security\_token: “{{ sessionToken }}”  
tags:  
Name: myInstanceName

Thoughts? Would it make sense to have a module doing this?

-Boris

---

<div class="post-metadata">

**Author:** ![Darvin\_Denmian](https://avatars.discourse-cdn.com/v4/letter/d/c68b51/32.png) [@Darvin\_Denmian](https://forum.ansible.com/u/Darvin_Denmian)\
**Post date:** [July 2, 2015, 8:53pm UTC](https://forum.ansible.com/t/multiple-aws-accounts-and-sts-assume-role-support/17131/3 "2015-07-02T20:53:49Z")

</div>

Does somebody solved this?  
Is the proposed solution given by Boris the only way to do that?

Thanks in advance.

---

<div class="post-metadata">

**Author:** ![kevin\_fernandes](https://avatars.discourse-cdn.com/v4/letter/k/db5fbb/32.png) [@kevin\_fernandes](https://forum.ansible.com/u/kevin_fernandes)\
**Post date:** [July 3, 2015, 12:21pm UTC](https://forum.ansible.com/t/multiple-aws-accounts-and-sts-assume-role-support/17131/4 "2015-07-03T12:21:01Z")

</div>

Hi,

I have a pull request for ec2.py to support multiple AWS accounts via STS.

[https://github.com/ansible/ansible/pull/11321](https://github.com/ansible/ansible/pull/11321)

I have a readme with the steps to setup with STS.

[https://github.com/linuxbsdfreak/ansible-ec2-sts](https://github.com/linuxbsdfreak/ansible-ec2-sts)

Regards,  
Kevin