How to use multiple AWS accounts from the command line?

You should be able to use the following command-options in lieu of the EC2_PRIVATE_KEY (and even EC2_CERT) environment variables:

• -K <private key>
• -C <certificate>

You can put these inside aliases, e.g.

alias ec2-describe-instances1 ec2-describe-instances -K /path/to/key.pem

IMHO, the easiest way is to edit .aws/credentials and .aws/config files manually.

It's easy and it works for Linux, Mac and Windows. Just read this for more detail (1 minute read).

.aws/credentials file:

[default]
aws_access_key_id=AKIAIOSFODNN7EXAMPLE
aws_secret_access_key=wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY

[user1]
aws_access_key_id=AKIAI44QH8DHBEXAMPLE
aws_secret_access_key=je7MtGbClwBF/2Zp9Utk/h3yCo8nvbEXAMPLEKEY

.aws/config file:

[default]
region=us-west-2
output=json

[profile user1]    <-- 'profile' in front of 'profile_name' (not for default)!!
region=us-east-1
output=text

create or edit this file:

% vim ~/.aws/credentials

list as many key pairs as you like:

[default]
aws_access_key_id=AKIAIOSFODNN7EXAMPLE
aws_secret_access_key=wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY

[user1]
aws_access_key_id=AKIAI44QH8DHBEXAMPLE
aws_secret_access_key=je7MtGbClwBF/2Zp9Utk/h3yCo8nvbEXAMPLEKEY

set a local variable to select the pair of keys you want to use:

% export AWS_PROFILE=user1

do what you like:

aws s3api list-buckets  # any aws cli command now using user1 pair of keys

you can also do it command by command if you would rather by including --profile user1 with each command:

aws s3api list-buckets --profile user1
# any aws cli command now using user1 pair of keys

more details: https://docs.aws.amazon.com/cli/latest/userguide/cli-configure-profiles.html

I created a simple tool, aaws, to switch between AWS accounts.

It works by setting the AWS_DEFAULT_PROFILE in your shell. Just make sure you have some entries in your ~/.aws/credentials file and it will easily switch between multiple accounts.

/tmp
$ aws s3 ls
Unable to locate credentials. You can configure credentials by running "aws configure".

/tmp
$ aaws luk3

[luk3]  /tmp
$ aws s3 ls
2013-11-05 21:40:04 luk3thomas.com

To use an IAM role, you have to make an API call to STS:AssumeRole, which will return a temporary access key ID, secret key, and security token that can then be used to sign future API calls. Formerly, to achieve secure cross-account, role-based access from the AWS Command Line Interface (CLI), an explicit call to STS:AssumeRole was required, and your long-term credentials were used. The resulting temporary credentials were captured and stored in your profile, and that profile was used for subsequent AWS API calls. This process had to be repeated when the temporary credentials expired (after 1 hour, by default).

https://aws.amazon.com/blogs/security/how-to-use-a-single-iam-user-to-easily-access-all-your-accounts-by-using-the-aws-cli/

I wrote a toolkit to switch default AWS profile.

The mechanism is physically moving the profile key to the default section in config and credentials files.

The better solution today should be one of the following ways:

• Use aws command option --profile.
• Use environment variable AWS_PROFILE.

I don't remember why I didn't use the solution of --profile, maybe I was not realized its existence.

However the toolkit can still be useful by doing other things. I'll add a soft switch flag by using the way of AWS_PROFILE in the future.

$ xsh list aws/cfg
[functions] aws/cfg/move
[functions] aws/cfg/set
[functions] aws/cfg/activate
[functions] aws/cfg/get
[functions] aws/cfg/delete
[functions] aws/cfg/list
[functions] aws/cfg/copy

Repo: https://github.com/xsh-lib/aws

Install:

curl -s https://raw.githubusercontent.com/alexzhangs/xsh/master/boot | bash && . ~/.xshrc
xsh load xsh-lib/aws

Usage:

xsh aws/cfg/list
xsh aws/cfg/activate <profilename>