The Assumer gem is an interface allowing the user to assume role into an account. Credentials can be loaded anywhere the AWS STS Client knows to load credentials from (ENV, profile, etc.)
Assumer will assume-role on a target account and generate temporary API keys for that account. It can optionally drop you into a pry session or load the AWS console in the context of the role assumed in the target account depending on how Assumer was called.
Assumer requires a Ruby version >= 2.1
Install with gem install assumer
cd assumer
source
folder, where the gem's source code lives
cd source
gem build assumer.gemspec
gem install assumer-0.4.2.gem
Having trouble running Assumer on Windows? Please see our document with some troubleshooting steps.
You can use the gem on the command line. For an in-depth explanation of options, see this file; what follows is a simplistic overview.
To see help text:
assumer -h
To see help textStandard usage:
assumer -a 123456789012 -r "target/role-name" -A 987654321098 -R "control/role-name"
To request a console, pass the -g
flag:
assumer -a 123456789012 -r "target_role/target_path" -A 987654321098 -R "control_role/control_path" -g
To request a pry console, pass the -p
flag:
assumer -a 123456789012 -r "target_role/target_path" -A 987654321098 -R "control_role/control_path" -p
Why not both?
assumer -a 123456789012 -r "target_role/target_path" -A 987654321098 -R "control_role/control_path" -p -g
Or use the gem in your code:
require 'assumer'
# First Jump
control_creds = Assumer::Assumer.new(
region: aws_region,
account: control_plane_account_number,
role: control_plane_role,
serial_number: serial_number, # if you are using MFA, this will be the ARN for the device
profile: credential_profile_name # if you don't want to use environment variables or the default credentials in your ~/.aws/credentials file
)
# Second jump
target_creds = Assumer::Assumer.new(
region: aws_region,
account: target_plane_account_number,
role: target_account_role,
credentials: control_creds
)