Is it possible to run aws cli from ec2 to create some resources in another account without using aws_secret_key and aws_access_key?


Sure, if the EC2 role allows STS::AssumeRole you can assume a role in the other account and get temporary credentials to do whatever you need to do in the other account.

See for example here: Cross Account Access with AWS-CLI

  • Thank you Mlu. I don't want to use access_key and secret_key inside ec2. Is it possible without aws config file(aws/credential) has access to other accounts? – Pzowghi Apr 5 at 3:29
  • @Pzowghi AWS-CLI can use your EC2 IAM Role to get local credentials and then use those to assume role in the other account to get temporary creds from there. No access/secret keys on the filesystem involved. – MLu Apr 5 at 3:32
  • I understand the concept. You shared the solution but there are access and secret key in that. If I don't have aws/credentials and aws/config how I could have different profiles for different accounts? – Pzowghi Apr 5 at 3:43
  • @Pzowghi Ah, true. Skip that first step, aws-cli will get the creds from EC2 IAM role by default. – MLu Apr 5 at 3:46

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.