如何在不设置 aws configure 的情况下使用 IAM 角色获得临时 IAM 编程访问？

Question

How to get temporary IAM programmatic access using IAM role without setting up aws configure ?

answer in python will be helpful

paste me full code if you have please.

Answer 1

(base) [root@ip-172-31-39-101 ec2-user]# cat role.py 

import boto3
import botocore
account_no=7439222006066 # another account number
role_name='iamest' # another account role
sts_client = boto3.client('sts')
assume_role_response = sts_client.assume_role(
                RoleArn = 'arn:aws:iam::{0}:role/{1}'.format(account_no,role_name),
                RoleSessionName = 'CloudWatchMetricRoleSession',
                DurationSeconds = 900,
                #ExternalId = '9949183895'
            )
#Below session is required to create request using temporary credentials generated.
session = boto3.Session(
                aws_access_key_id = assume_role_response['Credentials']['AccessKeyId'],
                aws_secret_access_key = assume_role_response['Credentials']['SecretAccessKey'],
                aws_session_token = assume_role_response['Credentials']['SessionToken']
            )
#print('your keys are here:', session)

#below we are specifying region for temporary credentials stored in 'session' same like we #configure region in 'aws configure'

cloudwatch_client = session.client('cloudwatch',
        region_name = 'us-east-1'
    )

all_metric_items = []

# using temporary credentials for a request.
cpu_util_metrices_response = cloudwatch_client.list_metrics(
        Namespace = 'AWS/EC2',
        MetricName = 'CPUUtilization',
        Dimensions = [
        {
          'Name': 'i-00a2e99dc0855d2b7',
          'Value': 'us-east-1'
        }
      ]
    )
print (cpu_util_metrices_response)

Note: 1) in another account role must be created for cross account and in trust-releationship policy add account id of the aws account from where you are hitting request. 2) The server from which you are running aws requests should have "aws configure" defined inorder to request another aws account temporary access keys. 3)same account cannot generate temporary access keys for requesting its resources