Kamal - AWS IAM Users with Multiple Roles

[Bozazitz]

If you have an AWS IAM user with multiple roles and need to switch between staging and production for the Kamal registry, here's a quick guide on how to do it efficiently.

deploy.yml

registry:
  server: 123123123.dkr.ecr.us-east-1.amazonaws.com # your endpoint
  username: AWS
  password: <%= %x(./ecr-login.sh) %>

ech-login.sh

#!/bin/bash

# Default to staging environment
ENVIRONMENT=${ENVIRONMENT:-staging}

if [ "$ENVIRONMENT" == "staging" ]; then
  ROLE_ARN="arn:aws:iam::123123:role/staging_role"
  SESSION_NAME="staging_session"
elif [ "$ENVIRONMENT" == "production" ]; then
  ROLE_ARN="arn:aws:iam::123123:role/production_role"
  SESSION_NAME="production_session"
else
  echo "Invalid environment. Use 'staging' or 'production'."
  exit 1
fi

# Assume the role and capture the credentials
CREDS=$(aws sts assume-role --role-arn $ROLE_ARN --role-session-name $SESSION_NAME --output json)

export AWS_ACCESS_KEY_ID=$(echo $CREDS | jq -r '.Credentials.AccessKeyId')
export AWS_SECRET_ACCESS_KEY=$(echo $CREDS | jq -r '.Credentials.SecretAccessKey')
export AWS_SESSION_TOKEN=$(echo $CREDS | jq -r '.Credentials.SessionToken')

# Get ECR login password
aws ecr get-login-password --region us-east-1

Don't forget to make your script executable with:
chmod +x ecr-login.sh

the login will default to staging, make sure the ENVIRONMENT variable is resolving to your application environment being used.