# Using source\_profile to assume role instead of fixed credentials

**URL:** <https://forum.ansible.com/t/using-source-profile-to-assume-role-instead-of-fixed-credentials/28827>\
**Category:** Ansible Developer\
**Tags:** aws\
**Created:** [October 19, 2018, 1:11pm UTC](https://forum.ansible.com/t/using-source-profile-to-assume-role-instead-of-fixed-credentials/28827 "2018-10-19T13:11:46Z")\
**Posts on this page:** 1\
**Page:** 1

<div class="post-metadata">

**Author:** ![Moises\_Margotto](https://avatars.discourse-cdn.com/v4/letter/m/ccd318/32.png) [@Moises\_Margotto](https://forum.ansible.com/u/Moises_Margotto)\
**Post date:** [October 19, 2018, 1:11pm UTC](https://forum.ansible.com/t/using-source-profile-to-assume-role-instead-of-fixed-credentials/28827/1 "2018-10-19T13:11:46Z")

</div>

Hi there.

My team uses Ansible to manage resources across lots of different AWS accounts, and we are looking to move from using static access keys and secrets to credentials granted by IAM assume role. To do this, we’d need Ansible to be able to read credentials in an ~/.aws/config, as shown in the example below

~/.aws/credentials

[access-normal]

aws\_access\_key\_id = XXXXXXXXXXXXXXXXXXX  
aws\_secret\_access\_key = XXXXXXXXXXXXXXXXXXX  
aws\_session\_token = XXXXXXXXXXXXXXXXXXX  
aws\_security\_token = XXXXXXXXXXXXXXXXXXX

~/.aws/config

[profile access-normal]  
output = text  
region = us-east-1

[profile powerUser]  
role\_arn = arn:aws:iam::XXXXXXXXXXXXX:role/PowerUser  
source\_profile = access-normal  
region = us-east-1

ref: [https://github.com/ansible/ansible/blob/devel/lib/ansible/module\_utils/ec2.py#L192](https://github.com/ansible/ansible/blob/devel/lib/ansible/module_utils/ec2.py#L192)

Do you think there is a version that use this format to access AWS resources (assuming role) for boto(2)?

Thanks