Support AWS datasources for cross account access.

[kirthiprakash]

It would be nice to support fetching AWS resources by acquiring temporary credentials by calling AWS STS assumeRole API for an IAM role of a different AWS account. gomplate can read a special environment variable which contains the IAM role ARN and hit the AWS STS endpoint to get temporary credentials.

The current documentation doesn't talk about the cross account access for AWS and hence I thought this could be an idea worth discussing and if it really has value, we can implement it.

[hairyhenderson]

Hi @kirthiprakash, this is an interesting idea!

One possibility that should already work is to configure a cross-account profile like this, and then setting AWS_PROFILE accordingly.

I guess another approach would be to call the aws sts assume-role command first, though this may be awkward to do programatically and I see how it'd be useful for gomplate to do this natively!

It's been a while since I've dealt deeply with the nuances of AWS IAM so I may have missed something... But let me know if either of those approaches work.

[kirthiprakash]

Yes, AWS_PROFILE (pointing to a different role) should do the job. Thanks!

I think I am now getting a clear picture on when this might be needed.
Incase a template file needs to access to 2 different accounts/endpoints of the same datasource type.

gomplate -d awsOne=aws+smp://some/path/in/AWS/accountOne -d awsTwo=aws+smp://path/in/AWS/accountTwo
gomplate -d vaultOne=vault://path/to/vault/server/one -d vaultTwo=vault://path/in/vault/server/two

I think the we can use a config file to define multiple datasources of the same type right?

[hairyhenderson]

I think the we can use a config file to define multiple datasources of the same type right?

yep, absolutely

[andreacavagna01]

You can also use Leapp to let leapp generate temporary credentials from your Cross account access and then use them with gomplate