{"action":"created","issue":{"url":"https://api.github.com/repos/hashicorp/terraform/issues/1275","repository_url":"https://api.github.com/repos/hashicorp/terraform","labels_url":"https://api.github.com/repos/hashicorp/terraform/issues/1275/labels{/name}","comments_url":"https://api.github.com/repos/hashicorp/terraform/issues/1275/comments","events_url":"https://api.github.com/repos/hashicorp/terraform/issues/1275/events","html_url":"https://github.com/hashicorp/terraform/issues/1275","id":63601561,"number":1275,"title":"Support for AWS access via IAM - AssumeRole","user":{"login":"ncraike","id":1109269,"avatar_url":"https://avatars.githubusercontent.com/u/1109269?v=3","gravatar_id":"","url":"https://api.github.com/users/ncraike","html_url":"https://github.com/ncraike","followers_url":"https://api.github.com/users/ncraike/followers","following_url":"https://api.github.com/users/ncraike/following{/other_user}","gists_url":"https://api.github.com/users/ncraike/gists{/gist_id}","starred_url":"https://api.github.com/users/ncraike/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/ncraike/subscriptions","organizations_url":"https://api.github.com/users/ncraike/orgs","repos_url":"https://api.github.com/users/ncraike/repos","events_url":"https://api.github.com/users/ncraike/events{/privacy}","received_events_url":"https://api.github.com/users/ncraike/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/hashicorp/terraform/labels/enhancement","name":"enhancement","color":"d4c5f9"},{"url":"https://api.github.com/repos/hashicorp/terraform/labels/provider/aws","name":"provider/aws","color":"bfdadc"}],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":48,"created_at":"2015-03-23T02:00:25Z","updated_at":"2016-06-14T05:04:51Z","closed_at":null,"body":"I get it's probably a lot of complexity to add, but it'd be great if Terraform supported using IAM roles in its AWS provider authentication.\r\n\r\nThis adds a few steps to how API credentials are used – you use your normal AWS access key and secret key to call `sts assume-role` in the API, and this responds with a temporary access key, secret key and session token which you use for the rest of the session. An example with AWS's own CLI is [here](http://docs.aws.amazon.com/IAM/latest/UserGuide/roles-walkthrough-crossacct-3-userole.html#roles-walkthrough-crossacct-3-userole-cli).\r\n\r\nThe big use case for this is cross-account access. We have lots of AWS accounts to isolate billing to individual projects, and we link these to one parent account with AWS's consolidated billing. The cross-account roles let us have one set of IAM users in the parent account (eg one IAM user for each actual developer using AWS), and then just a single IAM role in each sub-account, which the developers can assume when needed. This saves having to create a new set of IAM users in each sub-account.\r\n\r\nI imagine this would involve adding extra AWS provider config fields to describe the role to assume (using an AWS ARN like `arn:aws:iam::account-of-role-to-assume:role/name-of-role`), and would also involve changing the AWS API access layer to use the temporary role access/secret keys _and_ a session token.\r\n\r\nThis should be linked to the [AWS meta-issue](https://github.com/hashicorp/terraform/issues/28). I felt the explanation was long enough to warrant a full issue."},"comment":{"url":"https://api.github.com/repos/hashicorp/terraform/issues/comments/225780803","html_url":"https://github.com/hashicorp/terraform/issues/1275#issuecomment-225780803","issue_url":"https://api.github.com/repos/hashicorp/terraform/issues/1275","id":225780803,"user":{"login":"SydOps","id":8954908,"avatar_url":"https://avatars.githubusercontent.com/u/8954908?v=3","gravatar_id":"","url":"https://api.github.com/users/SydOps","html_url":"https://github.com/SydOps","followers_url":"https://api.github.com/users/SydOps/followers","following_url":"https://api.github.com/users/SydOps/following{/other_user}","gists_url":"https://api.github.com/users/SydOps/gists{/gist_id}","starred_url":"https://api.github.com/users/SydOps/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/SydOps/subscriptions","organizations_url":"https://api.github.com/users/SydOps/orgs","repos_url":"https://api.github.com/users/SydOps/repos","events_url":"https://api.github.com/users/SydOps/events{/privacy}","received_events_url":"https://api.github.com/users/SydOps/received_events","type":"User","site_admin":false},"created_at":"2016-06-14T05:04:51Z","updated_at":"2016-06-14T05:04:51Z","body":"I went through the most solutions in this ticket, I prefer to follow the standard AWS CLI (Command Line Interface) settings to use exist *.aws/credentials* and *.aws/config*.\r\n\r\nWhy we need manage two or more aws api configurations? Make it simple and no duplication. \r\n\r\n"}}
{"actor":{"display_login":"SydOps"}}