Can I update the assumed-role session name on an Amazon EC2 instance

user_1706504 0
Viewed 425

Inside an Amazon EC2 instance with an IAM role:

$ aws sts get-caller-identity
{
    "Account": "999999999999",
    "UserId": "AROA4AD2EEIE4XYIBOEYP:i-abcdefg12345678",
    "Arn": "arn:aws:sts::999999999999:assumed-role/my-instance-iam-role/i-abcdefg12345678"
}

The IAM role session name is the instance ID.

Is there a way to update this session name on the fly? For example temporarily change the assumed role session name

arn:aws:sts::999999999999:assumed-role/my-instance-iam-role/i-abcdefg12345678/specialSession

Or even

arn:aws:sts::999999999999:assumed-role/my-instance-iam-role/specialSession

(no instance id)

amazon-iam amazon-web-services amazon-ec2
1 Answers

For Amazon EC2 instance profiles, AWS sets the role session on your behalf and sets the role session name to the instance profile ID. If you want to change the role, you may consider assuming the role again and setting a new name for the role session :

$ aws sts assume-role --role-arn arn:aws:iam::999999999999:role/my-instance-iam-role --role-session-name newname

The command returns the required info for you the assume the role. Next, create three environment variables to assume the IAM role (please replace the value with the values from the previous command):

export AWS_ACCESS_KEY_ID=RoleAccessKeyID
export AWS_SECRET_ACCESS_KEY=RoleSecretKey
export AWS_SESSION_TOKEN=RoleSessionToken

You could run get-caller-identity again:

$ aws sts get-caller-identity 
{
    "UserId": "AROARXXXXX:newname",
    "Account": "999999999999",
    "Arn": "arn:aws:sts::999999999999:assumed-role/my-instance-iam-role/newname"
}
user_42907530
Related