Answers: <p>Sure, if the EC2 role allows <code>STS::AssumeRole</code> you can assume a role in the other account and get temporary credentials to do whatever you need to do in the other account.</p>
  
  <p>See for example here: <strong><a href="https://aws.nz/best-practice/cross-account-access-with-aws-cli/" rel="nofollow noreferrer">Cross Account Access with AWS-CLI</a></strong></p>
  
Answers: CC BY-SA 4.0
Answers: 2019-04-05T03:29:05.067Z
Answers: Thank you Mlu. I don't want to use access_key and secret_key inside ec2. Is it possible without aws config file(aws/credential) has access to other accounts?
Answers: Pzowghi
Answers: CC BY-SA 4.0
Answers: 2019-04-05T03:32:06.807Z
Answers: @Pzowghi AWS-CLI can use your *EC2 IAM Role* to get local credentials and then use those to *assume role* in the other account to get temporary creds from there. No access/secret keys on the filesystem involved.
Answers: MLu
Answers: CC BY-SA 4.0
Answers: 2019-04-05T03:43:43.387Z
Answers: I understand the concept. You shared the solution but there are access and secret key in that. If I don't have aws/credentials and aws/config how I could have different profiles for different accounts?
Answers: Pzowghi
Answers: CC BY-SA 4.0
Answers: 2019-04-05T03:46:14.640Z
Answers: @Pzowghi Ah, true. Skip that first step, aws-cli will get the creds from EC2 IAM role by default.
Answers: MLu
Answers: CC BY-SA 4.0
Answers: 2019-04-05T03:11:55.787Z
Answers: 2019-04-05T03:11:55.787Z
Answers: MLu
Answers: <p>Supposing the scenario with two accounts A &amp; B the explanatory steps should be:</p>
  
  <ol>
  <li>In <strong>account A</strong>, I created a <strong>role</strong> (e.g <code>RoleForB</code>) to trust <strong>account B</strong>, and attach to the before created role a <strong>IAM policy</strong> to allow it to perform some read operations in <strong>account A</strong>. <code>e.g ReadOnlyAccess</code></li>
  <li>In <strong>account B</strong>, I created a <strong>role</strong> (e.g <code>AssumeRoleInA</code>) and attach a <strong>policy</strong> to allow it to assume the role that is created in <strong>account A</strong>.</li>
  <li>In <strong>account B</strong> Associate to your EC2 instance <code>ec2-profile</code> the IAM role (<code>AssumeRoleInA</code>) created in step 2.</li>
  <li>In <strong>account B</strong> login into this EC2 instance to <strong>assume the role</strong> in <strong>Account A</strong> using the command <code>aws sts assume-role --role-arn "arn:aws:iam::Account_A_ID:role/RoleForB" --role-session-name "EC2FromB"</code>.</li>
  <li>In <strong>account B</strong> EC2 terminal when the command is <strong>step 4.</strong> finished, you can see the <strong>access key ID, secret access key, and session token</strong> from wherever you've routed it, in our case <code>stdout</code> either manually or by using a script. You can then assign these values to environment variables (<code>AWS_ACCESS_KEY_ID</code>, <code>AWS_SECRET_ACCESS_KEY</code>, <code>AWS_SESSION_TOKEN</code>)</li>
  </ol>
  
  <p>So Let’s check the configurations mentioned above step by step but with some mode detail:</p>
  
  <ol>
  <li>As before presented in <strong>account A</strong>, it builds the trust to <strong>account B</strong> by creating the role named <code>RoleForB</code> and attaching <code>ReadOnlyAccess</code> permission to it.</li>
  </ol>
  
  <pre><code>{
      "Version": "2012-10-17",
      "Statement": {
          "Effect": "Allow",
          "Principal": {"AWS": "arn:aws:iam::Account_B_ID:root"},
          "Action": "sts:AssumeRole"
      }
  }
  </code></pre>
  
  <ol start="2">
  <li>In <strong>account B</strong>, create a <strong>role</strong> named <code>AssumeRoleInA</code> then attach the corresponding <code>policy</code> to allow it to assume the role named <code>RoleForB</code> in <strong>account A</strong>.</li>
  </ol>
  
  <pre><code>{
    "Version": "2012-10-17",
    "Statement": [
      {
        "Effect": "Allow",
        "Action": "sts:AssumeRole",
        "Resource": [
          "arn:aws:iam::Account_A_ID:role/RoleForB"
        ]
      }
    ]
  }
  </code></pre>
  
  <ol start="3">
  <li>In <strong>account B</strong>, create a new <strong>EC2 instance</strong> (if it does not exists yet), and associate it's <strong>ec2-profile</strong> with the <strong>IAM role</strong> named <code>AssumeRoleInA</code>.</li>
  </ol>
  
  <pre><code>{
      "Version": "2012-10-17",
      "Statement": {
          "Effect": "Allow",
          "Principal": {"Service": "ec2.amazonaws.com"},
          "Action": "sts:AssumeRole"
      }
  }
  </code></pre>
  
  <ol start="4">
  <li>In <strong>account B</strong> login into this EC2 instance to <strong>assume the role</strong> in <strong>Account A</strong> using the command: </li>
  </ol>
  
  <pre><code>aws sts assume-role --role-arn "arn:aws:iam::Account_A_ID:role/RoleForB" --role-session-name "EC2FromB"`
  </code></pre>
  
  <p>eg:</p>
  
  <pre><code>jenkins@bb-jenkins-vault:~$ aws sts assume-role --role-arn arn:aws:iam::521111111144:role/DeployMaster --role-session-name "project-dev-jenkins-deploy"
  {
      "AssumedRoleUser": {
          "AssumedRoleId": "AROAJBXGEHOQBXGEHOQ:project-dev-jenkins-deploy", 
          "Arn": "arn:aws:sts::521111111144:assumed-role/DeployMaster/project-dev-jenkins-deploy"
      }, 
      "Credentials": {
          "SecretAccessKey": "wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY", 
          "SessionToken": "FQoGZXIvYXCUm8iG6/zLdQ7foognvCDpxKP7cRJiZgc...CUm8iG6/zLdQ7foognvCDpxKP7c+OQF", 
          "Expiration": "2019-03-29T15:41:02Z", 
          "AccessKeyId": "AKIAI44QH8DHBEXAMPLE"
      }
  }
  </code></pre>
  
  <ol start="5">
  <li>In <strong>account B</strong> EC2 terminal when the command is <strong>step 4.</strong> finished, you can see the <strong>access key ID, secret access key, and session token</strong> from wherever you've routed it, in our case <code>stdout</code> either manually or by using a script. You can then assign these values to environment variables</li>
  </ol>
  
  <pre><code>$ export AWS_ACCESS_KEY_ID=AKIAI44QH8DHBEXAMPLE
  $ export AWS_SECRET_ACCESS_KEY=wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY
  $ export AWS_SESSION_TOKEN=FQoGZXIvYXCUm8iG6/zLdQ...&lt;remainder of security token&gt;
  $ aws ec2 describe-instances --region us-east-1
  </code></pre>
  
  <p><strong>credit:</strong> <a href="https://stackoverflow.com/a/55420220/6657158">https://stackoverflow.com/a/55420220/6657158</a></p>
  
Answers: CC BY-SA 4.0
Answers: 2020-04-07T23:07:11.403Z
Answers: 2020-04-08T00:16:11.713Z
Answers: 2020-04-08T00:16:11.713Z
Answers: Chan Nyein Ko Ko
Body: <p>Is it possible to run aws cli from ec2 to create some resources in another account without using aws_secret_key and aws_access_key?</p>
  
Tags: <amazon-ec2><aws-cli><aws-iam>
Title: Cross account access from ec2 to other accounts
UserDisplayName: Pzowghi
ThreadText: # Cross account access from ec2 to other accounts
  
  (Asked by: username_0 on 2019-04-05)
  
  Is it possible to run aws cli from ec2 to create some resources in another account without using aws\_secret\_key and aws\_access\_key?
  
  **Tags:** amazon-ec2, aws-cli, aws-iam
  
  
  ---
  
  ## 2 answers
  
  ### Answer by username_2 on 2020-04-07. Score: 3 | Accepted answer
  
  Supposing the scenario with two accounts A & B the explanatory steps should be:
  
  1. In **account A**, I created a **role** (e.g `RoleForB`) to trust **account B**, and attach to the before created role a **IAM policy** to allow it to perform some read operations in **account A**. `e.g ReadOnlyAccess`
  2. In **account B**, I created a **role** (e.g `AssumeRoleInA`) and attach a **policy** to allow it to assume the role that is created in **account A**.
  3. In **account B** Associate to your EC2 instance `ec2-profile` the IAM role (`AssumeRoleInA`) created in step 2.
  4. In **account B** login into this EC2 instance to **assume the role** in **Account A** using the command `aws sts assume-role --role-arn "arn:aws:iam::Account_A_ID:role/RoleForB" --role-session-name "EC2FromB"`.
  5. In **account B** EC2 terminal when the command is **step 4.** finished, you can see the **access key ID, secret access key, and session token** from wherever you've routed it, in our case `stdout` either manually or by using a script. You can then assign these values to environment variables (`AWS_ACCESS_KEY_ID`, `AWS_SECRET_ACCESS_KEY`, `AWS_SESSION_TOKEN`)
  
  So Let’s check the configurations mentioned above step by step but with some mode detail:
  
  1. As before presented in **account A**, it builds the trust to **account B** by creating the role named `RoleForB` and attaching `ReadOnlyAccess` permission to it.
  
  ```
  {
      "Version": "2012-10-17",
      "Statement": {
          "Effect": "Allow",
          "Principal": {"AWS": "arn:aws:iam::Account_B_ID:root"},
          "Action": "sts:AssumeRole"
      }
  }
  
  ```
  
  2. In **account B**, create a **role** named `AssumeRoleInA` then attach the corresponding `policy` to allow it to assume the role named `RoleForB` in **account A**.
  
  ```
  {
    "Version": "2012-10-17",
    "Statement": [
      {
        "Effect": "Allow",
        "Action": "sts:AssumeRole",
        "Resource": [
          "arn:aws:iam::Account_A_ID:role/RoleForB"
        ]
      }
    ]
  }
  
  ```
  
  3. In **account B**, create a new **EC2 instance** (if it does not exists yet), and associate it's **ec2-profile** with the **IAM role** named `AssumeRoleInA`.
  
  ```
  {
      "Version": "2012-10-17",
      "Statement": {
          "Effect": "Allow",
          "Principal": {"Service": "ec2.amazonaws.com"},
          "Action": "sts:AssumeRole"
      }
  }
  
  ```
  
  4. In **account B** login into this EC2 instance to **assume the role** in **Account A** using the command:
  
  ```
  aws sts assume-role --role-arn "arn:aws:iam::Account_A_ID:role/RoleForB" --role-session-name "EC2FromB"`
  
  ```
  
  eg:
  
  ```
  jenkins@bb-jenkins-vault:~$ aws sts assume-role --role-arn arn:aws:iam::521111111144:role/DeployMaster --role-session-name "project-dev-jenkins-deploy"
  {
      "AssumedRoleUser": {
          "AssumedRoleId": "AROAJBXGEHOQBXGEHOQ:project-dev-jenkins-deploy", 
          "Arn": "arn:aws:sts::521111111144:assumed-role/DeployMaster/project-dev-jenkins-deploy"
      }, 
      "Credentials": {
          "SecretAccessKey": "wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY", 
          "SessionToken": "FQoGZXIvYXCUm8iG6/zLdQ7foognvCDpxKP7cRJiZgc...CUm8iG6/zLdQ7foognvCDpxKP7c+OQF", 
          "Expiration": "2019-03-29T15:41:02Z", 
          "AccessKeyId": "AKIAI44QH8DHBEXAMPLE"
      }
  }
  
  ```
  
  5. In **account B** EC2 terminal when the command is **step 4.** finished, you can see the **access key ID, secret access key, and session token** from wherever you've routed it, in our case `stdout` either manually or by using a script. You can then assign these values to environment variables
  
  ```
  $ export AWS_ACCESS_KEY_ID=AKIAI44QH8DHBEXAMPLE
  $ export AWS_SECRET_ACCESS_KEY=wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY
  $ export AWS_SESSION_TOKEN=FQoGZXIvYXCUm8iG6/zLdQ...<remainder of security token>
  $ aws ec2 describe-instances --region us-east-1
  
  ```
  
  **credit:** <https://stackoverflow.com/a/55420220/6657158>
  
  
  ---
  
  ### Answer by username_1 on 2019-04-05. Score: 2
  
  Sure, if the EC2 role allows `STS::AssumeRole` you can assume a role in the other account and get temporary credentials to do whatever you need to do in the other account.
  
  See for example here: **[Cross Account Access with AWS-CLI](https://aws.nz/best-practice/cross-account-access-with-aws-cli/)**
  
  > **Comments:**
  > **username_0**: Thank you Mlu. I don't want to use access_key and secret_key inside ec2. Is it possible without aws config file(aws/credential) has access to other accounts?  
  > **username_1**: @username_0 AWS-CLI can use your *EC2 IAM Role* to get local credentials and then use those to *assume role* in the other account to get temporary creds from there. No access/secret keys on the filesystem involved.  
  > **username_0**: I understand the concept. You shared the solution but there are access and secret key in that. If I don't have aws/credentials and aws/config how I could have different profiles for different accounts?  
  > **username_1**: @username_0 Ah, true. Skip that first step, aws-cli will get the creds from EC2 IAM role by default.  
  
  ---
  
  