Partial credentials found in assume-role, missing: source_profile or credential_source

Question

I have configured the IAM user and IAM role within the same AWS account to setup AWS CLI for my team.
When i try to use these credentials to run some command, i get the above error in CLI.
What should i be doing?

I have given the IAM role trust policy to assume role for anyone in the same AWS account.
I have added policy for the IAM user to assume the above IAM role.

```
~/.aws/credentials

[regionsadmin]
aws_access_key_id = ******
aws_secret_access_key = ******
```

```
~.aws/config
[profile regionsadmin]
region = us-east-1
output = json
source_profile = regionsadmin

[default]
role_arn = arn:aws:iam::****:role/regionsclirole
```

secondabhi_aws · Accepted Answer

If you refer [AWS CLI Configuration Variables](https://docs.aws.amazon.com/cli/latest/topic/config-vars.html) documentation, take a look at section **Using AWS IAM Roles**.

I'm not sure why you'd setup CLI to assume role in same account. Refer [re:Post Knowledge Center Article](https://repost.aws/knowledge-center/iam-assume-role-cli) for same account IAM Assume Role CLI.

For cross account setup, your entry should look like as below:

# In ~/.aws/credentials:
      [regionsadmin]
      aws_access_key_id = ******
      aws_secret_access_key = ******

# In ~/.aws/config
      [profile crossaccount]
      region = us-east-1
      output = json
      source_profile = regionsadmin
      role_arn=arn:aws:iam::****:role/regionsclirole

For same account setup, your entry should look like as below:

# In ~/.aws/credentials:
      [regionsadmin]
      aws_access_key_id = ******
      aws_secret_access_key = ******

# In ~/.aws/config
      [profile crossaccount]
      region = us-east-1
      output = json
      source_profile = regionsadmin
      role_arn=arn:aws:iam::****:role/regionsclirole

## Edit:
I just tested this in house and it works absolutely fine as expected even within same account. User for which I saved credentials, had only sts assume role permissions where as the role which it assumed had getsecretvalue permissions. Attaching snapshot for your reference:

![Enter image description here](/media/postImages/original/IMEb0nz88TSYyXUuvspgbjnQ)

Hope you find this useful.

Comment here if you have additional questions, happy to help.

Abhishek

Partial credentials found in assume-role, missing: source_profile or credential_source

Edit:

添加回答

相关内容