STS support for deploy

• Expected behaviour: It should create and deploy both the Api Gateway endpoint and the Lambda function
• What actually happens: I get an AccessDenied error due to the restrictions our operations operations team imposes. Here is the output

initialising IAM role   iam.createRole  RoleName=claudia-hello-world-executor
{ [AccessDenied: User: arn:aws:iam::XXXXXXXXX:user/francisco.calle is not authorized to perform: iam:CreateRole on resource: arn:aws:iam::XXXXXXXXX:role/claudia-hello-world-executor]
  cause:
   { [AccessDenied: User: arn:aws:iam::XXXXXXXXX:user/francisco.calle is not authorized to perform: iam:CreateRole on resource: arn:aws:iam::XXXXXXXXX:role/claudia-hello-world-executor]
     message: 'User: arn:aws:iam::XXXXXXXXX:user/francisco.calle is not authorized to perform: iam:CreateRole on resource: arn:aws:iam::XXXXXXXXX:role/claudia-hello-world-executor',
     code: 'AccessDenied',
     time: Thu Sep 15 2016 17:41:22 GMT+0200 (CEST),
     requestId: 'da51dd6d-7b5a-11e6-acfe-07a6295c8f0a',
     statusCode: 403,
     retryable: false,
     retryDelay: 78.65617338102311 },
  isOperational: true,
  code: 'AccessDenied',
  time: Thu Sep 15 2016 17:41:22 GMT+0200 (CEST),
  requestId: 'da51dd6d-7b5a-11e6-acfe-07a6295c8f0a',
  statusCode: 403,
  retryable: false,
  retryDelay: 78.65617338102311 }

• Link to a minimal, executable project that demonstrates the problem: No need, I’m just using the hello world example
• Steps to reproduce the problem: Execute claudia --role-arn arn:aws:iam::XXXXXXXXX:role/dev-project-delegated-developer --role-arn-name corp-session-default --profile corp-session-default create --region us-east-1 --api-module index
• Extra information: I’ve made a repo based on another project to deploy a lambda function that illustrates how we have to make the deployments https://github.com/beeva-franciscocalle/beeva-aws-node-lambda

[briancsparks]

Assuming you have IAM roles setup properly, https://docs.aws.amazon.com/cli/latest/reference/sts/assume-role.html gives most of the info. The trick is to use the AWS CLI (aws sts assume-role …) to assume the right role, but then you have to manually stuff the credentials into environment variables.

aws sts assume-role --role-arn arn:aws:...:role/supercow --role-session-name foobar > /tmp/creds
export AWS_SECRET_ACCESS_KEY="$(cat /tmp/creds | jq '.Credentials.SecretAccessKey')"
# similar for AWS_ACCESS_KEY_ID and AWS_SESSION_TOKEN

rm -f /tmp/creds

# Claudia is now happy
claudia create ...

With ~/.aws/config similar to:

[profile claudia]
aws_access_key_id = ABC123
aws_secret_access_key = adsfger1243

[profile xaccount]
role_arn = arn:aws:...:role/supercow
source_profile = claudia

[gojko]

I also found this gem, it might help: http://docs.aws.amazon.com/cli/latest/userguide/cli-roles.html