{"id":27849,"date":"2015-10-09T23:26:07","date_gmt":"2015-10-09T17:56:07","guid":{"rendered":"http:\/\/www.tothenew.com\/blog\/?p=27849"},"modified":"2016-01-19T13:30:14","modified_gmt":"2016-01-19T08:00:14","slug":"unifying-control-of-multiple-aws-accounts-by-using-aws-sts","status":"publish","type":"post","link":"https:\/\/www.tothenew.com\/blog\/unifying-control-of-multiple-aws-accounts-by-using-aws-sts\/","title":{"rendered":"Unifying control of multiple AWS accounts by using AWS STS"},"content":{"rendered":"

Recently, we came across a scenario where we need to create AMIs of multiple production servers running in four different AWS accounts. One solution was to create an automation script to be run on an AWS EC2 instance running in each aws account which would create AMI of all production servers running in each account. This would have landed us in managing four scripts for each account doing the same task. But for any devops engineer<\/a>, this redundancy and extra overhead would never be acceptable.<\/p>\n

One out of the four accounts was our main account where most of our services were running and we wanted to use this account to automate AMI creation of all production servers running in the other three accounts.<\/p>\n

Scenario<\/strong>: Create\u00a0an AMI creation script to be executed from an\u00a0AWS EC2 instance running in main AWS account, which will create AMIs of productions servers running in other three AWS accounts.<\/p>\n

We would be using AWS Secure Token Service (STS) to achieve our goal. STS provides six api calls out of which we will be using the below api call:<\/p>\n

AssumeRole<\/b><\/p>\n

AssumeRole api call returns the temporary security credentials which includes:<\/p>\n