Boto3 STS AssumeRole with MFA Working Example

Question

What am I doing wrong here? I'm able to assume the roles via aws cli as well as boto if I use:

boto3.setup_default_session(profile_name="ROLE_TO_ASSUME")

What I'm trying to do: I have a number of AWS accounts my script needs to run in. I'm tired of typing my mfa each time I need to run the script on a different profile/role.

I get this error message with the code below:

 User: arn:aws:iam::<management account>:user/Ops/<my user> is not authorized to perform: sts:AssumeRole on resource

Our AWS is setup like this: I am a user, part of a group on a management account. The group has a trust relationship set up with the ROLE_TO_ASSUME role on each account.

Here's my python:

import boto3

def main():
    boto3.setup_default_session(profile_name="default")
    ec2 = boto3.client('ec2')
    get_assumerole_credentials('arn:aws:iam::<REPLACE WITH ACCOUNTID>:role/ROLE_TO_ASSUME')

def get_assumerole_credentials(arn):
    sts_client = boto3.client('sts')
    # Use client object and pass the role ARN
    assumedRoleObject = sts_client.assume_role(RoleArn=arn,

RoleSessionName="AssumeRoleCredstashSession1")
    credentials = assumedRoleObject['Credentials']
    return dict(aws_access_key_id=credentials['AccessKeyId'],
            aws_secret_access_key=credentials['SecretAccessKey'],
            aws_session_token=credentials['SessionToken'])

if __name__ == "__main__":
    main()

Here's my ~/.aws/config

[profile default]
region = us-west-2
output = json
aws_access_key_id=<censored>
aws_secret_access_key=<censored>

[profile ROLE_TO_ASSUME]
region = us-west-2
source_profile = default
role_arn = arn:aws:iam::<accountid>:role/ROLE_TO_ASSUME
mfa_serial = arn:aws:iam::<accountid>:mfa/<my_user>

EDIT based on first reply:
To be clear, I am able to assume a role if I specify the 'profile' argument as in the following example:

boto3.setup_default_session(profile_name='ROLE_TO_ASSUME')
ec2 = boto3.resource('ec2', region_name='us-west-1')

But I need to assume a role and within the script using boto3's STS to get temp credentials.
I've noticed there is no MFA prompt when I use the boto3 STS assume role method of connecting.

It is not as simple. AssumeRoles does not work in user account level alone, you must also grant assume roles to whatever AWS services that you want to grant. — mootmoot
ok but I thought I did that because I can assume role using aws config "profiles". Just boto sts does not work. I don't understand what you are trying to say. — buildmaestro
It is quite tricky, I will just give you the reference. You need to test out those constraints. docs.aws.amazon.com/cli/latest/reference/sts/assume-role.html — mootmoot

Dzmitry Lazerka Dzmitry Lazerka · Accepted Answer · 2019-02-01T06:01:25

All other solutions here do not refresh the assumed credentials. But they do expire (in 15 minutes by default, but you can set it longer when doing the AssumeRole call, up to your current session max API session duration time, by default -- 1 hour).

If you need to automatically refresh the credentials, here I'm sharing my code I wrote after several hours of studying boto's code and trying to work around boto's dependency on file system and profiles.

Here I just used built-in boto's mechanism of caching and regularly refreshing the assumed credentials without touching any files:

from datetime import datetime

import boto3
from botocore.credentials import (
    AssumeRoleProvider,
    AssumeRoleCredentialFetcher,
    DeferredRefreshableCredentials,
    CredentialResolver
)
from dateutil.tz import tzlocal


class RamAssumeRoleProvider(AssumeRoleProvider):
    """
    Overrides default AssumeRoleProvider to not use profiles from filesystem.
    """

    def __init__(self,
                 source_session: boto3.Session,
                 assume_role_arn: str,
                 expiry_window_seconds: int):
        super().__init__(
            load_config=lambda: source_session._session.full_config,
            client_creator=source_session._session.create_client,
            cache={},
            profile_name='not-used'
        )
        self.expiry_window_seconds = expiry_window_seconds
        self.source_session = source_session
        self.assume_role_arn = assume_role_arn
        assert assume_role_arn, "assume_role_arn is required"

    def load(self):
        fetcher = AssumeRoleCredentialFetcher(
            client_creator=self.source_session._session.create_client,
            source_credentials=self.source_session.get_credentials(),
            role_arn=self.assume_role_arn,
            expiry_window_seconds=self.expiry_window_seconds,
            cache=self.cache,
        )

        return DeferredRefreshableCredentials(
            method=self.METHOD,
            refresh_using=fetcher.fetch_credentials,
            time_fetcher=lambda: datetime.now(tzlocal())
        )


def get_assume_role_session(
    source_session: boto3.Session,
    assume_role_arn: str,
    expiry_window_seconds=15 * 60
) -> boto3.Session:
    """
    Creates a new boto3 session that will operate as of another user.

    Source session must have permission to call sts:AssumeRole on the provided ARN,
    and that ARN role must have been trusted to be assumed from this account (where source_session is from).

    See https://docs.aws.amazon.com/IAM/latest/UserGuide/tutorial_cross-account-with-roles.html

    Uses internal session._session to hack it together, as I haven't found another way.
    """
    # must have .load() method to be used in CredentialsResolver.
    provider = RamAssumeRoleProvider(
        source_session=source_session,
        assume_role_arn=assume_role_arn,
        expiry_window_seconds=expiry_window_seconds
    )

    # must have .load_credentials() method to be used in register_component()
    resolver = CredentialResolver([provider])
    new_session = boto3.Session()
    new_session._session.register_component('credential_provider', resolver)
    return new_session

Boto3 STS AssumeRole with MFA Working Example

5 Answers