BitBucket Pipelines - AWS Assume roles

Tri Tran_urbctq

What I need:

I'm using BitBucket Pipelines to run my build and deployment tasks targeted for AWS Lambda functions. Our AWS configuration requires that the AWS CLI commands run under an assumed role which will target a different AWS account - one for each environment (e.g. Test, Staging, Production, etc).

 

What I've tried:

• I tried to update the ~/.aws/credentials during a pipeline step (this was what is required during local builds) but the file seems not accessible (no access to /root?)
• I tried to configure the `AWS_SHARED_CREDENTIALS_FILE` env to point to a local `aws_credentials` file but that didn't work.

 

Any ideas?

ccorrigacscf

The aws cli assume role (https://docs.aws.amazon.com/cli/latest/userguide/cli-configure-role.html) is easiest to use through the aws config files,  alternative being to do aws sts assume-role, which doesn't easily work with bitbucket.

I'd applied this with the following ugly hack,

set up the following environment variables, adjust <values> to suit your needs:

AWS_PROFILE=bitbot
AWS_CONFIG_FILE=/tmp/.awsconfig

AWS_SHARED_CREDENTIALS_FILE=/tmp/.awscreds

AWS_CONFIG_CONTENT=[default]\nregion = <Organization-region>\n[profile bitbot]\nregion = <assumed-builder-role-region>

AWS_CREDS_CONTENT=[default]\naws_access_key_id = <Organization-user-key-id>\naws_secret_access_key = <Organization-user-secret-token>\n[bitbot]\nrole_arn = arn:aws:iam::<Organization-AWS-A/C-No.>:role/<assumed-builder-role>\nsource_profile = default

and made sure AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY are NOT set

 

Then in the bitbucket pipeline, inject the aws config file content :

script:

   - echo -e $AWS_CONFIG_CONTENT > $AWS_CONFIG_FILE

   - echo -e $AWS_CREDS_CONTENT > $AWS_SHARED_CREDENTIALS_FILE

   - eval $(aws ecr get-login --no-include-email)

   ......