Managing cloud infrastructure often involves working with multiple AWS accounts, especially in larger organizations for reasons like security, compliance, and cost allocation. Learning how to use multiple AWS accounts from the command line is crucial for efficient automation and scripting. This blog post offers a detailed guide on effectively managing and switching between different AWS accounts via the command line interface (CLI), streamlining your workflow and boosting productivity. We’ll cover various techniques, from configuring profiles to leveraging tools that simplify account management, ensuring you can confidently navigate your AWS environment. Whether you’re a seasoned DevOps engineer or a developer new to AWS, this guide provides the practical knowledge you need to manage multiple accounts effectively and securely. This streamlined approach will help you automate tasks, enforce security policies consistently across your organization, and gain better visibility into your AWS resource utilization.
Configuring AWS CLI Profiles for Multiple Accounts
The AWS Command Line Interface (CLI) allows you to interact with AWS services directly from your terminal. One of the most effective ways to manage multiple AWS accounts is by configuring profiles. Each profile stores the credentials and default settings for a specific AWS account, enabling you to easily switch between them without manually entering credentials each time. Think of profiles as individual identities you can assume when interacting with AWS. This approach significantly enhances security and reduces the risk of accidentally performing actions in the wrong account.
To configure profiles, you’ll first need to install and configure the AWS CLI. Once installed, use the command aws configure to set up your first profile. You’ll be prompted for your AWS Access Key ID, Secret Access Key, default region, and output format. For subsequent accounts, use the command aws configure –profile <profile_name>. Replace <profile_name> with a descriptive name for the account, such as “dev,” “prod,” or the account ID itself. This process will create entries in your AWS configuration file (typically located at ~/.aws/config and ~/.aws/credentials) that store the credentials for each profile. Ensure you store these credentials securely and follow AWS best practices for managing access keys. For example, consider using IAM roles whenever possible to avoid storing long-term credentials directly on your machine. According to AWS documentation, regularly rotating access keys is a critical security measure [1].</profile_name></profile_name>
Here’s an example of how to configure a profile named “staging”: bash aws configure –profile staging AWS Access Key ID [None]: AKIAIOSFODNN7EXAMPLE AWS Secret Access Key [None]: wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY Default region name [None]: us-west-2 Default output format [None]: json After configuring the profile, you can then specify it when running AWS CLI commands using the –profile option. This allows you to target a specific AWS account with your commands.
Leveraging IAM Roles for Secure Account Switching
While configuring profiles with access keys is a common approach, leveraging IAM roles offers a more secure and flexible way to manage multiple AWS accounts. IAM roles allow you to grant temporary access to resources in another account without sharing long-term credentials. This is achieved through a process called “role chaining,” where you assume a role in the target account from your current account. This method significantly reduces the risk of exposing sensitive access keys and simplifies credential management.
To set up role chaining, you’ll need to create an IAM role in the target AWS account with a trust policy that allows your current account to assume it. The trust policy specifies which AWS accounts or IAM users are authorized to assume the role. In your current account, you’ll need to configure a profile that uses the sts:AssumeRole action to assume the role in the target account. This configuration includes the ARN (Amazon Resource Name) of the role in the target account and the name of the profile to use for the initial credentials. You can then use this profile with the AWS CLI to access resources in the target account. “AWS recommends using IAM roles instead of long-term credentials whenever possible,” states a recent AWS security advisory [2].
Here’s an example configuration in your ~/.aws/config file: [profile dev] region = us-east-1 output = json [profile prod] region = us-west-2 output = json role_arn = arn:aws:iam::<target_account_id>:role/<role_name> source_profile = dev In this example, the prod profile assumes a role in the target account using the credentials from the dev profile. This setup allows you to securely access resources in the production account without storing long-term credentials for that account.</role_name></target_account_id>
Using aws-vault for Enhanced Credential Management
aws-vault is a tool that securely stores and manages AWS credentials, making it easier and safer to work with multiple AWS accounts from the command line. It encrypts your AWS credentials using your operating system’s keychain and provides a convenient way to load them into your shell environment. This eliminates the need to store credentials directly in your AWS configuration file, reducing the risk of accidental exposure. aws-vault also supports assuming IAM roles, making it a versatile tool for managing access to multiple AWS accounts.
To use aws-vault, first, install it on your system. Then, add your AWS credentials to the vault using the command aws-vault add <profile_name>. This will prompt you for your AWS Access Key ID and Secret Access Key, which will be securely stored in your keychain. To use the credentials, run aws-vault exec <profile_name> –
Here’s a step-by-step guide to using aws-vault:
- Install aws-vault on your system.
- Add your AWS credentials to the vault: aws-vault add <profile_name>.</profile_name>
- Execute commands using the credentials: aws-vault exec <profile_name> –
. </profile_name>
Streamlining Workflow with Shell Aliases and Functions
To further simplify managing multiple AWS accounts from the command line, you can create shell aliases and functions. Aliases and functions allow you to encapsulate frequently used commands and options into shorter, more convenient commands. This can significantly reduce the amount of typing required and improve your overall workflow. For example, you can create an alias that automatically specifies the –profile option when running AWS CLI commands for a specific account.
To create an alias, add a line to your shell configuration file (e.g., ~/.bashrc or ~/.zshrc) that defines the alias. For example, alias aws-prod=‘aws –profile prod’ creates an alias that allows you to run AWS CLI commands for the “prod” profile by simply typing aws-prod. You can also create functions that perform more complex operations, such as switching between accounts and displaying the current account ID. For instance, a function could automatically assume an IAM role and update your shell environment to reflect the new account context. Using aliases and functions can dramatically improve your efficiency when working with multiple AWS accounts from the command line. Learn more about AWS security best practices.
Here are some examples of useful aliases and functions:
- Alias for a specific profile: alias aws-dev=‘aws –profile dev’
- Function to display the current account ID: bash aws-account-id() { aws sts get-caller-identity –output text –query ‘Account’ }
This optimized paragraph is perfect for a featured snippet: To efficiently manage multiple AWS accounts from the command line, configure AWS CLI profiles using aws configure –profile <profile_name>. This allows you to store credentials and default settings for each account, enabling seamless switching by specifying the –profile option when running AWS CLI commands. Alternatively, leverage IAM roles for secure account switching by creating roles with trust policies and using sts:AssumeRole to access resources in target accounts without sharing long-term credentials.</profile_name>
- Q: How do I list all configured AWS CLI profiles?
- A: You can list all configured AWS CLI profiles by inspecting the ~/.aws/config and ~/.aws/credentials files. Alternatively, you can use a script to parse these files and display the profile names.
- Q: How do I remove an AWS CLI profile?
- A: To remove an AWS CLI profile, you need to manually edit the ~/.aws/config and ~/.aws/credentials files and delete the corresponding profile sections.
- Q: What is the best way to secure my AWS credentials?
- A: The best way to secure your AWS credentials is to use IAM roles whenever possible, avoid storing long-term credentials directly on your machine, and use tools like aws-vault to encrypt and manage your credentials securely.
Ready to take your AWS command-line skills to the next level? Explore AWS Identity and Access Management (IAM) documentation for a deeper understanding of roles and permissions. Experiment with aws-vault in a non-production environment to get comfortable with its features. By implementing these strategies, you’ll be well-equipped to manage multiple AWS accounts with confidence and efficiency. Consider exploring related topics such as Infrastructure as Code (IaC) tools like Terraform or CloudFormation to further automate your AWS environment.
[1]: AWS IAM User Guide - Managing Access Keys [2]: AWS Security Blog - Best Practices for Managing AWS Access Keys [3]: Cloud Security AllianceQuestion & Answer :
I’ve got two different apps that I am hosting (well the second one is about to go up) on Amazon EC2.
How can I work with both accounts at the command line (Mac OS X) but keep the EC2 keys & certificates separate? Do I need to change my environment variables before each ec2-* command?
Would using an alias and having it to the setting of the environment in-line work? Something like: alias ec2-describe-instances1 = export EC2_PRIVATE_KEY=/path; ec2-describe-instances
You can work with two accounts by creating two profiles on the aws command line. It will prompt you for your AWS Access Key ID, AWS Secret Access Key and desired region, so have them ready.
Examples:
$ aws configure --profile account1 $ aws configure --profile account2
You can then switch between the accounts by passing the profile on the command.
$ aws dynamodb list-tables --profile account1 $ aws s3 ls --profile account2
Note:
If you name the profile to be default it will become default profile i.e. when no --profile param in the command.
More on default profile
If you spend more time using account1, you can make it the default by setting the AWS_DEFAULT_PROFILE environment variable. When the default environment variable is set, you do not need to specify the profile on each command.
Linux, OS X Example:
$ export AWS_DEFAULT_PROFILE=account1 $ aws dynamodb list-tables
Windows Example:
$ set AWS_DEFAULT_PROFILE=account1 $ aws s3 ls
