Sceptre: recommended way for cross account usage?

[networkpadawan]

Hi, what is the sceptre maintainers recommendation for cross account usage wit sceptre v2?
It worked very well with iam_roles but it was deprecated. using the migration guide role_arn does not work, the profile used is always the default one.
A previous issue spoke about using a workaround script.
Cross account usage is a bedrock feature and on our side we have been delaying our sceptre migration due to the lack of this feature. Many thanks

[SaMnCo]

Hi @networkpadawan,

I am no maintainer yet but heavy user of Sceptre, and been through the migration from v1 to v2 already.

You can use profile in your config.yaml file, and refer to various profiles in your ~/.aws/config file. Note however that sceptre will always look at your ENV first, so in case have some AWS_xxx environment variable set, you might get some unexpected results.

As an example for our setup we use make targets via a ./make file, which unsets all AWS ENV "just in case" and it works just fine. Been very happy with Sceptre so far, it bridges a lot of gaps we had with CF only.

In terms of migration from v1, the sticky point for us has been more about the transition from stack_path to command_path and the fact that the graph evaluation happens first and globally in the project rather than on a per stack basis. But it can be worked around by a combination of hard coded paths in dependencies and deployments with the --ignore-dependencies flag.

Don't hesitate to ping me if you are having some issues with this (Twitter @SaMnCo_23 if need be) and we can arrange a quick discussion if that's useful to you.

[ngfgrant]

Guys appreciate the honest feedback and it’s good to hear where things go well and where pain is.

Let’s look to see if we can add role_arn back in without breaking stuff and I there is a patch in the works for the global loading thing.

[networkpadawan]

don´t take me wrong, sceptre has been a good help for us, we are managing a few hundred stacks with it and no major issues so far. the unique "complaint" if you want to call it is really the migration part that has not be easy for us.

@SaMnCo how are you injecting the master profile variables? currently we use jenkins credentials, but it breaks as you stated when we want to use the role_arn.

@ngfgrant any eta for iam_role?

Many thanks all

[ngfgrant]

@hreeder may be able to contribute to this in the near future.

[SaMnCo]

Not sure what you mean by "injecting the master profile variables" here,
assuming this is about authentication.

Our AWS access is controlled via 2 methods:

• On dev laptops, IAM Account with MFA, then role delegation with different
  profiles in ~/.aws/config file. Assuming a user is authenticated, Sceptre
  will understand how to use a profile with the --profile tag and apply the
  Cross Account role that maps to that profile. It looks like:

```[profile iam]
mfa_serial=AAAA12345678

[profile dev]
role_arn = arn:aws:iam::111222333444:role/CrossAccountDevRole
source_profile = iam
output = json
region = us-east-2
```

• On CI/CD, everything runs on AWS, so access is already driven by IAM
  roles that AWS converts into ENV for us. One way of doing this if your
  Jenkins does not stand on AWS is to drive CodeBuild projects (there is a
  plugin for it). These projects are essentially Docker images that run with
  a given IAM Role, and execute commands stored in a buildspec file (similar
  to a Jenkins file). You can use the default images provided (one per
  language available on Lambda essentially) or provide your own if you don't
  want to reinstall sceptre at every run.

I hope this helps, but don't hesitate to come back to me if I misunderstood
the question.
Best,
Sam

On Sun, Jul 21, 2019 at 4:38 PM networkpadawan [e-mail]
wrote:

don´t take me wrong, sceptre has been a good help for us, we are managing
a few hundred stacks with it and no major issues so far. the unique
"complaint" if you want to call it is really the migration part that has
not be easy for us.

@SaMnCo https://github.com/SaMnCo how are you injecting the master
profile variables? currently we use jenkins credentials, but it breaks as
you stated when we want to use the role_arn.

@ngfgrant https://github.com/ngfgrant any eta for iam_role?

Many thanks all

—
You are receiving this because you were mentioned.
Reply to this email directly, view it on GitHub
https://github.com/Sceptre/sceptre/issues/796?email_source=notifications&email_token=AARXQ57WP6O3IZDCV4UJW73QAR7G3A5CNFSM4IEIRNYKYY3PNVWWK3TUL52HS4DFVREXG43VMVBW63LNMVXHJKTDN5WW2ZLOORPWSZGOD2OF76Q#issuecomment-513564666,
or mute the thread
https://github.com/notifications/unsubscribe-auth/AARXQ5ZO33HUS73ZNHQZRBTQAR7G3ANCNFSM4IEIRNYA
.

--
SaM'n'Co
R'U Ready? I was BORN ready!

[hreeder]

No ETA on the iam_role just yet - I will admit I got a bit sidetracked with another open issue I've been working on turning out to be a bit more complex than I assumed, however I aim to give some time this week to start looking at adding iam_role back. After that I should be able to give a better ETA.

[nabeelamjad]

@networkpadawan would you be able to test out https://github.com/Sceptre/sceptre/pull/799 to see if that meets your needs?

I was one of the contributors that removed iam_role in favour of profiles as that was the agreed decision back then, but we found that was not really helpful if you had to create a profile or curate a profile in a specific way to make it work. It felt much easier just to provide a role to be assumed with whatever credentials are active.

[networkpadawan]

of course, can you just point me to how to patch this pr into my local version?

[nabeelamjad]

You should be able to upgrade your current sceptre CLI by using

pip install git+https://github.com/nabeelamjad/sceptre@sceptre-iam-role-feature --upgrade

(pip with pip3 if needed)

To revert simply uninstall and reinstall sceptre. Just make sure you do this on a local test environment as the PR hasn't been reviewed yet.

[ngfgrant]

@networkpadawan - yep what @nabeelamjad said. We will look to get this in asap

[networkpadawan]

i´ve been testing the pr for the last couple of days. it seems to work fine! great work @nabeelamjad :)

[networkpadawan]

this seems stable on my tests so far, any way to merge to master? would like the team to start using it:)

[networkpadawan]

Guys, any blocker on this? how can we help on merging this to official release?

[nabeelamjad]

I believe it still needs to be PR'd properly, @ngfgrant

[ngfgrant]

Yeh sorry guys off on holiday this week will defo have this in the next release.

[ngfgrant]

Merged