Update IAM settings for your Workspace

Cloud9 normally manages IAM credentials dynamically. For this workshop we will disable it and rely on the IAM role instead.

  • Return to your workspace and click the gear icon (in top right corner), or click to open a new tab and choose “Open Preferences”
  • Select AWS SETTINGS
  • Turn off AWS managed temporary credentials
  • Close the Preferences tab c9disableiam

To ensure temporary credentials aren’t already in place we will also remove any existing credentials file:

rm -vf ${HOME}/.aws/credentials

We should configure our aws cli with our current region as default.

If you are at an AWS event, ask your instructor which AWS region to use.

export ACCOUNT_ID=$(aws sts get-caller-identity --output text --query Account)
export AWS_REGION=$(curl -s 169.254.169.254/latest/dynamic/instance-identity/document | jq -r '.region')

Check if AWS_REGION is set to desired region

test -n "$AWS_REGION" && echo AWS_REGION is "$AWS_REGION" || echo AWS_REGION is not set

Let’s save these into bash_profile

echo "export ACCOUNT_ID=${ACCOUNT_ID}" | tee -a ~/.bash_profile
echo "export AWS_REGION=${AWS_REGION}" | tee -a ~/.bash_profile
aws configure set default.region ${AWS_REGION}
aws configure get default.region

Validate the IAM role

Use the GetCallerIdentity CLI command to validate that the Cloud9 IDE is using the correct IAM role.

aws sts get-caller-identity

The output assumed-role name should contain: 


serverless-catalog-workshop-admin

VALID

If the Arn contains the role name from above and an Instance ID, you may proceed.


{
    "Account": "123456789012",
    "UserId": "AROA1SAMPLEAWSIAMROLE:i-01234567890abcdef",
    "Arn": "arnsts:assumed-role/serverless-catalog-workshop-admin/i-01234567890abcdef"
}

INVALID

If the _Arn contains TeamRole, MasterRole, or does not match the role name output above, DO NOT PROCEED. Go back and confirm the steps on this page.


{
    "Account": "123456789012",
    "UserId": "AROA1SAMPLEAWSIAMROLE:i-01234567890abcdef",
    "Arn": "arnsts:assumed-role/TeamRole/MasterRole"
}