How to create profiles to run AWS commands using taskflow command tasks in a serverless runtime environment

Back Next

Creating profiles

You can create an AWS configuration file with the required profiles or use the default AWS profile. This eliminates the effort of changing command task scripts and adding AWS profile information to commands individually.

When you create an AWS configuration file, you must name the file as

serverless_default_aws_config

. Place the file in the same folder where the command scripts or script files are located.

The

serverless_default_aws_config

configuration file contains profiles as shown in the following sample:

[default]
region = us-west-2
role_arn= arn:aws:iam::123456789012:role/cli-role
source_profile = cli-user
mfa_serial = arn:aws:iam::123456789012:mfa/cli-user

[profile role-with-mfa]
region = us-west-2
role_arn= arn:aws:iam::123456789012:role/cli-role
source_profile = cli-user
mfa_serial = arn:aws:iam::123456789012:mfa/cli-user

You must adhere to the AWS profiles formatting standard when creating profiles in the

serverless_default_aws_config

file.

If the user does not provide the AWS configuration file, that is, the

serverless_default_aws_config

file, a default profile is automatically created at run time. This default profile uses the same authentication information that is provided while creating the serverless runtime environment. This default profile runs any AWS command or script.

The user profile defined in the

serverless_default_aws_config

file takes precedence over the default profile. You can also override the profile using your own configuration or access mechanisms by adding the command scripts at the same location as the script files and referencing them in the script files.

Profile usage scenarios

Consider the following scenarios to understand how the profiles are used to run AWS commands:

If the user has created the

serverless_default_aws_config

file and defined profiles as shown in the following sample:

[default]
region = us-west-2
role_arn= arn:aws:iam::123456789012:role/cli-role
source_profile = cli-user
mfa_serial = arn:aws:iam::123456789012:mfa/cli-user

[profile 1]
region = us-west-2
role_arn= arn:aws:iam::123456789012:role/cli-role
source_profile = cli-user
mfa_serial = arn:aws:iam::123456789012:mfa/cli-user

[profile 2]
region = us-west-2
role_arn= arn:aws:iam::123456789321:role/cli-role
source_profile = cli-user
mfa_serial = arn:aws:iam::123456789321:mfa/cli-user

When you run the script or command with a specific profile, if the profile matches the profile name in the

serverless_default_aws_config

file, profile-specific authentication is used. For example, if the user specifies profile 1 in the command, the authentication specified in the profile 1 section is applied.

If the user does not provide the profile to be used in the script or command, the authentication provided in the default section is applied.

If the user provides the profile in the script or command that is not available in the

serverless_default_aws_config

file, the command fails with an error stating that the profile is not found. For example, if the user provides profile 3 in the command which is not defined in the configuration file, the command fails with an error.

If the user has created the

serverless_default_aws_config

file, but it does not contain the default section. When you run the script or command, if the profile matches the profile name in the

serverless_default_aws_config

file, profile-specific authentication is used. Otherwise, the default profile that uses user authentication is applied.

If the user does not provide the

serverless_default_aws_config

file, the default profile that uses user authentication is applied.

For information about how to use the command script file in Command Task step in taskflow, see Command Task step documentation.

Overview

Download Guide

Watch