Enable support for --profile option

[matthewdfuller]

trafficstars

Allow multiple profiles to be used using AWS's CLI option for profiles.

[w1bble]

Awesome, thanks for opening this Matt

[matthewdfuller]

Adding some notes here based on our testing so far.

1. This will likely be a bit more difficult than expected if we use the traditional, AWS-supported route of passing the --profile flag.
2. The reason is that we pass a custom AWS config object (containing credentials) to the individual plugins which then modify them to change the region. This functionality is core to our caching mechanism.
3. When using the profile flag, the object that is returned does not contain the credentials required for the plugins to work, but rather a reference to the config file.
4. There may be a middle-ground solution where we can define a list of available credentials in a separate file (or even use the existing ~/.aws/config.json file and load that at runtime.

We'll continue to investigate and update.

[hhh0505]

Is this something expected to be supported? I have multiple accounts and would love to test against those with a solution like this.

[kallu]

Maybe you could use a simple wrapper script to get around the problem. This is assuming you have IAM role you can assume on account and then run Cloudsploit with that role. I've been using something like this for similar purposes. Change ROLE2ASSUME to match what your IAM role is called.

cloudsploit-wrapper.txt

[jchrisfarris]

If --profile was specified, could you use STS:GetSessionToken to grab the three elements you populate into the AWSConfig object?

[varunchandak]

I do similar to @kallu but in case anyone needs a one-liner:

export CREDS="$(aws sts get-session-token)" && export AWS_ACCESS_KEY_ID="$(echo $CREDS | jq -r .Credentials.AccessKeyId)"; export AWS_SECRET_ACCESS_KEY="$(echo $CREDS | jq -r .Credentials.SecretAccessKey)"; export AWS_SESSION_TOKEN="$(echo $CREDS | jq -r .Credentials.SessionToken)"

Thanks @jchrisfarris for the idea :-)