using profile that assume role in aws-sdk (AWS JavaScript SDK)

Question

Using the AWS SDK for JavaScript, I want to use a default profile that assumes the a role. This works perfectly with the AWS CLI. Using node.js with the SDK does not assume the role, but only uses credentials to the AWS account that the access key belongs to. I've found this documentation but it does not deal with assuming a role: Loading Credentials in Node.js from the Shared Credentials File

Any tips?

This is my config file:

[default]
role_arn = arn:aws:iam::123456789:role/Developer
source_profile = default
output = json
region = us-east-1

Answer 1

The CLI and SDK work differently, in that you must explicitly assume the role when using the SDK. The SDK doesn't automatically assume the role from the config as the CLI does.

After the role is assumed, the AWS.config must be updated with the new credentials.

This works for me:

var AWS = require('aws-sdk');
AWS.config.region = 'us-east-1';

var sts = new AWS.STS();
sts.assumeRole({
  RoleArn: 'arn:aws:iam::123456789:role/Developer',
  RoleSessionName: 'awssdk'
}, function(err, data) {
  if (err) { // an error occurred
    console.log('Cannot assume role');
    console.log(err, err.stack);
  } else { // successful response
    AWS.config.update({
      accessKeyId: data.Credentials.AccessKeyId,
      secretAccessKey: data.Credentials.SecretAccessKey,
      sessionToken: data.Credentials.SessionToken
    });
  }
});

Answer 2

The right way to use multiple cross account roles in the code:

Get the credentials for the cross account role with sts and use those credentials every time you need to get a service authenticated with that specific cross account role.

Example:

Create a function to get the cross account credentials like:

const AWS = require('aws-sdk');
const sts = new AWS.STS();

const getCrossAccountCredentials = async () => {
  return new Promise((resolve, reject) => {
    const timestamp = (new Date()).getTime();
    const params = {
      RoleArn: 'arn:aws:iam::123456789:role/Developer',
      RoleSessionName: `be-descriptibe-here-${timestamp}`
    };
    sts.assumeRole(params, (err, data) => {
      if (err) reject(err);
      else {
        resolve({
          accessKeyId: data.Credentials.AccessKeyId,
          secretAccessKey: data.Credentials.SecretAccessKey,
          sessionToken: data.Credentials.SessionToken,
        });
      }
    });
  });
}

And then you can use it without problems like:

const main = async () => {
  // Get the Cross account credentials
  const accessparams = await getCrossAccountCredentials();
  // Get the ec2 service for current account
  const ec2 = new AWS.EC2();
  // Get the ec2 service for cross account role
  const ca_ec2 = new AWS.EC2(accessparams);
  // Get the autoscaling service for current account
  const autoscaling = new AWS.AutoScaling();
  // Get the autoscaling service for cross account role
  const ca_autoscaling = new AWS.AutoScaling(accessparams);

  // This will describe instances within the cross account role
  ca_ec2.describeInstances(...) 

  // This will describe instances within the original account
  ec2.describeInstances(...)

  // Here you can access both accounts without issues.
}

Benefits:

• Does not change the credentials globally, so you can still target your own AWS account without having to backup the credentials in advance to restore it.
• Allows to control exactly what account you're targeting in every moment.
• Allows to handle multiple cross account roles and services.

The wrong way:

DO NOT USE AWS.config.update to override the global credentials AWS.config.credentials!!!

Override the global credentials is a bad practice!! This is same situation as @Brant's approved solution here but it is no good solution! Here is why:

const main = async () => {
  // Get the Cross account credentials
  const accessparams = await getCrossAccountCredentials();

  // Get the ec2 service for current account
  const ec2 = new AWS.EC2();

  // Overwrite the AWS credentials with cross account credentilas
  AWS.config.update(accessparams);

  // Get the ec2 service for cross account role
  const ca_ec2 = new AWS.EC2();

  // This will describe instances within the cross account role
  ca_ec2.describeInstances(...) 

  // This will ALSO describe instances within the cross account role
  ec2.describeInstances(...)

  // WARNING: Here you only will access the cross account role. You may get
  // confused on what you're accessing!!!
}

Issues:

• Updating global AWS.config.credentials directly or by AWS.config.update, will override current credentials.
• Everything will point to that cross account role, even future service calls that you may not expect.
• To switch back to first account you may need to temporary backup AWS.config.credentials and update it again to restore it. It is hard to control when you use each account, it is hard to trace execution context, and easy to mess up by targeting the wrong account.

Again, DO NOT USE AWS.config.update to override the global credentials AWS.config.credentials!!!

If you need to run the code entirely in another account:

If you need to execute your code entirely for another account without switching between credentials. You can follow the advice from @Kanak Singhal and store the role_arn in the config file and add AWS_SDK_LOAD_CONFIG="true" to the environment variable along with AWS_PROFILE="assume-role-profile".

Answer 3

A bit late to the party, but now the simplest way is probably to use the AWS.ChainableTemporaryCredentials

It refreshes the credentials automatically as well as being chainable in many layers or as here use the default credentials

AWS.config.credentials = new AWS.ChainableTemporaryCredentials({
  params: {RoleArn: 'RoleARN', RoleSessionName: 'RoleSessionName'}
});

https://docs.aws.amazon.com/AWSJavaScriptSDK/latest/AWS/ChainableTemporaryCredentials.html

Me myself found this question when I wanted to run with an assumed role, so guess it still have some SEO power!

Answer 4

Found the correct way to do it! Check out this PR: https://github.com/aws/aws-sdk-js/pull/1391

Just had to add AWS_SDK_LOAD_CONFIG="true" to the environment variable along with AWS_PROFILE="assume-role-profile"

So it doesn’t require any code update

This is because, the SDK only loads credentials file by default, not the config file, but since AWS role_arn is stored in the config file, we must enable loading the config file as well.

Answer 5

Per https://docs.aws.amazon.com/AWSJavaScriptSDK/v3/latest/migrating/notable-changes/, In node js aws-sdk v3, the AWS.ChainableTemporaryCredentials that Erik Karlsson helpfully pointed out has been replaced with fromTemporaryCredentials a la

import { FooClient } from "@aws-sdk/client-foo";
import { fromTemporaryCredentials } from "@aws-sdk/credential-providers"; // ES6 import
// const { FooClient } = require("@aws-sdk/client-foo");
// const { fromTemporaryCredentials } = require("@aws-sdk/credential-providers"); // CommonJS import

const sourceCredentials = {
  // A credential can be a credential object or an async function that returns a credential object
};
const client = new FooClient({
  credentials: fromTemporaryCredentials({
    masterCredentials: sourceCredentials,
    params: { RoleArn },
  }),
});

masterCredentials is optional, if you omit it the default credentials will be used to assume the provided role.