StackExchange / dnscontrol

Infrastructure as code for DNS!
https://dnscontrol.org/
MIT License
3.07k stars 389 forks source link

FEATURE REQUEST: Support multiple AWS Profiles #2393

Open followsound opened 1 year ago

followsound commented 1 year ago

We've started using DNSControl in our business, and I have used for a long time now; firstly thank you very much for this project!

Currently we have domains spread across multiple AWS accounts all using SSO, and have some options for using DNSControl across multiple accounts, but all have flaws:

We don't want to use static credentials as everything is SSO, but this means we have to use profiles.

Currently I'm getting round this by exporting each AWS profile to environment variables (i.e. AWS_KEY_FOR_ACCOUNT_1, AWS_KEY_FOR_ACCOUNT_n, etc)

What would be lovely, to keep consistency between environments, if one could specify the AWS_PROFILE in the creds.js, something like:

{
  "R53_ACCOUNT_1": {
    "TYPE": "ROUTE53",
    "Profile": "ACCOUNT_1"
  },
  "R53_ACCOUNT_2": {
    "TYPE": "ROUTE53",
    "Profile": "ACCOUNT_2"
  },
  "R53_ACCOUNT_n": {
    "TYPE": "ROUTE53",
    "Profile": "ACCOUNT_n"
  }
}
tlimoncelli commented 1 year ago

@tresni (route53 maintainer) for suggestions.

I don't know much about AWS but I would accept a PR for this.

followsound commented 1 year ago

Thanks @tlimoncelli ❤️ - I feel bad for not being able to provide a PR, but happy to test whenever needed.

tlimoncelli commented 1 year ago

I have another suggestion (similar to your original idea):

Use a different pipeline and --config dnsconfig-pipelinename.js for each user. That will compartmentalize things better. If there is common code, you can use require() to import a shared library.