<p>Sure, if the EC2 role allows <code>STS::AssumeRole</code> you can assume a role in the other account and get temporary credentials to do whatever you need to do in the other account.</p>

<p>See for example here: <strong><a href="https://aws.nz/best-practice/cross-account-access-with-aws-cli/" rel="nofollow noreferrer">Cross Account Access with AWS-CLI</a></strong></p>

CC BY-SA 4.0
2019-04-05T03:29:05.067Z
Thank you Mlu. I don't want to use access_key and secret_key inside ec2. Is it possible without aws config file(aws/credential) has access to other accounts?
Pzowghi
CC BY-SA 4.0
2019-04-05T03:32:06.807Z
@Pzowghi AWS-CLI can use your *EC2 IAM Role* to get local credentials and then use those to *assume role* in the other account to get temporary creds from there. No access/secret keys on the filesystem involved.
MLu
CC BY-SA 4.0
2019-04-05T03:43:43.387Z
I understand the concept. You shared the solution but there are access and secret key in that. If I don't have aws/credentials and aws/config how I could have different profiles for different accounts?
Pzowghi
CC BY-SA 4.0
2019-04-05T03:46:14.640Z
@Pzowghi Ah, true. Skip that first step, aws-cli will get the creds from EC2 IAM role by default.
MLu
CC BY-SA 4.0
2019-04-05T03:11:55.787Z
2019-04-05T03:11:55.787Z
MLu
<p>Supposing the scenario with two accounts A &amp; B the explanatory steps should be:</p>

<ol>
<li>In <strong>account A</strong>, I created a <strong>role</strong> (e.g <code>RoleForB</code>) to trust <strong>account B</strong>, and attach to the before created role a <strong>IAM policy</strong> to allow it to perform some read operations in <strong>account A</strong>. <code>e.g ReadOnlyAccess</code></li>
<li>In <strong>account B</strong>, I created a <strong>role</strong> (e.g <code>AssumeRoleInA</code>) and attach a <strong>policy</strong> to allow it to assume the role that is created in <strong>account A</strong>.</li>
<li>In <strong>account B</strong> Associate to your EC2 instance <code>ec2-profile</code> the IAM role (<code>AssumeRoleInA</code>) created in step 2.</li>
<li>In <strong>account B</strong> login into this EC2 instance to <strong>assume the role</strong> in <strong>Account A</strong> using the command <code>aws sts assume-role --role-arn "arn:aws:iam::Account_A_ID:role/RoleForB" --role-session-name "EC2FromB"</code>.</li>
<li>In <strong>account B</strong> EC2 terminal when the command is <strong>step 4.</strong> finished, you can see the <strong>access key ID, secret access key, and session token</strong> from wherever you've routed it, in our case <code>stdout</code> either manually or by using a script. You can then assign these values to environment variables (<code>AWS_ACCESS_KEY_ID</code>, <code>AWS_SECRET_ACCESS_KEY</code>, <code>AWS_SESSION_TOKEN</code>)</li>
</ol>

<p>So Let’s check the configurations mentioned above step by step but with some mode detail:</p>

<ol>
<li>As before presented in <strong>account A</strong>, it builds the trust to <strong>account B</strong> by creating the role named <code>RoleForB</code> and attaching <code>ReadOnlyAccess</code> permission to it.</li>
</ol>

<pre><code>{
    "Version": "2012-10-17",
    "Statement": {
        "Effect": "Allow",
        "Principal": {"AWS": "arn:aws:iam::Account_B_ID:root"},
        "Action": "sts:AssumeRole"
    }
}
</code></pre>

<ol start="2">
<li>In <strong>account B</strong>, create a <strong>role</strong> named <code>AssumeRoleInA</code> then attach the corresponding <code>policy</code> to allow it to assume the role named <code>RoleForB</code> in <strong>account A</strong>.</li>
</ol>

<pre><code>{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": "sts:AssumeRole",
      "Resource": [
        "arn:aws:iam::Account_A_ID:role/RoleForB"
      ]
    }
  ]
}
</code></pre>

<ol start="3">
<li>In <strong>account B</strong>, create a new <strong>EC2 instance</strong> (if it does not exists yet), and associate it's <strong>ec2-profile</strong> with the <strong>IAM role</strong> named <code>AssumeRoleInA</code>.</li>
</ol>

<pre><code>{
    "Version": "2012-10-17",
    "Statement": {
        "Effect": "Allow",
        "Principal": {"Service": "ec2.amazonaws.com"},
        "Action": "sts:AssumeRole"
    }
}
</code></pre>

<ol start="4">
<li>In <strong>account B</strong> login into this EC2 instance to <strong>assume the role</strong> in <strong>Account A</strong> using the command: </li>
</ol>

<pre><code>aws sts assume-role --role-arn "arn:aws:iam::Account_A_ID:role/RoleForB" --role-session-name "EC2FromB"`
</code></pre>

<p>eg:</p>

<pre><code>jenkins@bb-jenkins-vault:~$ aws sts assume-role --role-arn arn:aws:iam::521111111144:role/DeployMaster --role-session-name "project-dev-jenkins-deploy"
{
    "AssumedRoleUser": {
        "AssumedRoleId": "AROAJBXGEHOQBXGEHOQ:project-dev-jenkins-deploy", 
        "Arn": "arn:aws:sts::521111111144:assumed-role/DeployMaster/project-dev-jenkins-deploy"
    }, 
    "Credentials": {
        "SecretAccessKey": "wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY", 
        "SessionToken": "FQoGZXIvYXCUm8iG6/zLdQ7foognvCDpxKP7cRJiZgc...CUm8iG6/zLdQ7foognvCDpxKP7c+OQF", 
        "Expiration": "2019-03-29T15:41:02Z", 
        "AccessKeyId": "AKIAI44QH8DHBEXAMPLE"
    }
}
</code></pre>

<ol start="5">
<li>In <strong>account B</strong> EC2 terminal when the command is <strong>step 4.</strong> finished, you can see the <strong>access key ID, secret access key, and session token</strong> from wherever you've routed it, in our case <code>stdout</code> either manually or by using a script. You can then assign these values to environment variables</li>
</ol>

<pre><code>$ export AWS_ACCESS_KEY_ID=AKIAI44QH8DHBEXAMPLE
$ export AWS_SECRET_ACCESS_KEY=wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY
$ export AWS_SESSION_TOKEN=FQoGZXIvYXCUm8iG6/zLdQ...&lt;remainder of security token&gt;
$ aws ec2 describe-instances --region us-east-1
</code></pre>

<p><strong>credit:</strong> <a href="https://stackoverflow.com/a/55420220/6657158">https://stackoverflow.com/a/55420220/6657158</a></p>

CC BY-SA 4.0
2020-04-07T23:07:11.403Z
2020-04-08T00:16:11.713Z
2020-04-08T00:16:11.713Z
Chan Nyein Ko Ko
<p>Is it possible to run aws cli from ec2 to create some resources in another account without using aws_secret_key and aws_access_key?</p>

<amazon-ec2><aws-cli><aws-iam>
Cross account access from ec2 to other accounts
Pzowghi
# Cross account access from ec2 to other accounts

(Asked by: username_0 on 2019-04-05)

Is it possible to run aws cli from ec2 to create some resources in another account without using aws\_secret\_key and aws\_access\_key?

**Tags:** amazon-ec2, aws-cli, aws-iam


---

## 2 answers

### Answer by username_2 on 2020-04-07. Score: 3 | Accepted answer

Supposing the scenario with two accounts A & B the explanatory steps should be:

In account A, I created a role (e.g RoleForB) to trust account B, and attach to the before created role a IAM policy to allow it to perform some read operations in account A. e.g ReadOnlyAccess
In account B, I created a role (e.g AssumeRoleInA) and attach a policy to allow it to assume the role that is created in account A.
In account B Associate to your EC2 instance ec2-profile the IAM role (AssumeRoleInA) created in step 2.
In account B login into this EC2 instance to assume the role in Account A using the command aws sts assume-role --role-arn "arn:aws:iam::Account_A_ID:role/RoleForB" --role-session-name "EC2FromB".
In account B EC2 terminal when the command is step 4. finished, you can see the access key ID, secret access key, and session token from wherever you've routed it, in our case stdout either manually or by using a script. You can then assign these values to environment variables (AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY, AWS_SESSION_TOKEN)

So Let’s check the configurations mentioned above step by step but with some mode detail:

As before presented in account A, it builds the trust to account B by creating the role named RoleForB and attaching ReadOnlyAccess permission to it.

{
    "Version": "2012-10-17",
    "Statement": {
        "Effect": "Allow",
        "Principal": {"AWS": "arn:aws:iam::Account_B_ID:root"},
        "Action": "sts:AssumeRole"
    }
}


In account B, create a role named AssumeRoleInA then attach the corresponding policy to allow it to assume the role named RoleForB in account A.

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": "sts:AssumeRole",
      "Resource": [
        "arn:aws:iam::Account_A_ID:role/RoleForB"
      ]
    }
  ]
}


In account B, create a new EC2 instance (if it does not exists yet), and associate it's ec2-profile with the IAM role named AssumeRoleInA.

{
    "Version": "2012-10-17",
    "Statement": {
        "Effect": "Allow",
        "Principal": {"Service": "ec2.amazonaws.com"},
        "Action": "sts:AssumeRole"
    }
}


In account B login into this EC2 instance to assume the role in Account A using the command: 

aws sts assume-role --role-arn "arn:aws:iam::Account_A_ID:role/RoleForB" --role-session-name "EC2FromB"`

eg:
jenkins@bb-jenkins-vault:~$ aws sts assume-role --role-arn arn:aws:iam::521111111144:role/DeployMaster --role-session-name "project-dev-jenkins-deploy"
{
    "AssumedRoleUser": {
        "AssumedRoleId": "AROAJBXGEHOQBXGEHOQ:project-dev-jenkins-deploy", 
        "Arn": "arn:aws:sts::521111111144:assumed-role/DeployMaster/project-dev-jenkins-deploy"
    }, 
    "Credentials": {
        "SecretAccessKey": "wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY", 
        "SessionToken": "FQoGZXIvYXCUm8iG6/zLdQ7foognvCDpxKP7cRJiZgc...CUm8iG6/zLdQ7foognvCDpxKP7c+OQF", 
        "Expiration": "2019-03-29T15:41:02Z", 
        "AccessKeyId": "AKIAI44QH8DHBEXAMPLE"
    }
}


In account B EC2 terminal when the command is step 4. finished, you can see the access key ID, secret access key, and session token from wherever you've routed it, in our case stdout either manually or by using a script. You can then assign these values to environment variables

$ export AWS_ACCESS_KEY_ID=AKIAI44QH8DHBEXAMPLE
$ export AWS_SECRET_ACCESS_KEY=wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY
$ export AWS_SESSION_TOKEN=FQoGZXIvYXCUm8iG6/zLdQ...
$ aws ec2 describe-instances --region us-east-1

credit: https://stackoverflow.com/a/55420220/6657158


---

### Answer by username_1 on 2019-04-05. Score: 2

Sure, if the EC2 role allows `STS::AssumeRole` you can assume a role in the other account and get temporary credentials to do whatever you need to do in the other account.

See for example here: **[Cross Account Access with AWS-CLI](https://aws.nz/best-practice/cross-account-access-with-aws-cli/)**

> **Comments:**
> **username_0**: Thank you Mlu. I don't want to use access_key and secret_key inside ec2. Is it possible without aws config file(aws/credential) has access to other accounts?  
> **username_1**: @username_0 AWS-CLI can use your *EC2 IAM Role* to get local credentials and then use those to *assume role* in the other account to get temporary creds from there. No access/secret keys on the filesystem involved.  
> **username_0**: I understand the concept. You shared the solution but there are access and secret key in that. If I don't have aws/credentials and aws/config how I could have different profiles for different accounts?  
> **username_1**: @username_0 Ah, true. Skip that first step, aws-cli will get the creds from EC2 IAM role by default.  

---

