DevOps Series - Multiple AWS CLI Accounts

Lack of direction, not lack of time, is the problem. We all have twenty-four hour days.

~ Zig Ziglar.

As a DevOps, I handle multiple projects all at once, and one problem I kept running into was managing multiple AWS accounts for different startups. Each client had their own account, their own credentials, and their own production environments, and juggling them all with a single AWS CLI setup was a recipe for disaster. The last thing you want is to deploy client A’s stack into client B’s account.

So how do we handle multiple AWS accounts? The answer is a built in feature of the AWS CLI called profiles, and once you get the hang of it, switching between accounts becomes a single flag on every command.

✅ Prerequisites

Before you start doing this, I assume you already know the basic command line interface, whether it’s for Windows or from *Nix (Linux, macOS, Unix) derivatives. And also you must have a python interpreter with at least version 3 above, since the AWS CLI itself is a Python package.

🧰 Multiple, Multiple to the Nth

First, if you haven’t got the AWS CLI (Command Line Interface), install it using the command pip install --upgrade --user awscli. The command will install the awscli package in your local python dist directory.

And now we begin. You’ll need to generate first your AWS access key and secret access key. Here are the steps:

• Go to IAM Console
• Go to Users in the navigation pane and select your IAM username.
• Select Security credentials and choose Create access key.

Treat those keys like passwords, because they basically are. Anyone holding them can operate your AWS account, so store them somewhere safe and never commit them to a repository.

Then, after that we will need to configure our AWS using aws configure --profile <your-profile-name>:

aws configure --profile my-profile-name

This command will need some more input from you like your AWS Key, AWS Secret, AWS Account Region and the default output format which would be JSON or TEXT. The profile name is what ties all of these together, so pick something recognizable like the client or project name, and repeat the whole process for every account you manage.

If everything is set up properly, we can proceed with running some sample commands. Also, in order for you to use the configured AWS profile, you must always append at the end of your AWS command the --profile <your-profile-name>:

aws configure --profile my-profile-name

Or if you know you will be using it for a while, export an environment variable AWS_PROFILE containing the profile name like export AWS_PROFILE=<your-profile-name>:

export AWS_PROFILE=my-profile-name

Setting AWS_PROFILE is the lazy person’s way and I mean that in the best sense: every command in that shell session automatically uses the right account, and when the session ends, so does the switch.

And cheers, you can now use multiple credentials through AWS CLI.

🧠 Final Thoughts

Hi guys, a quick tip from me: sometimes, having multiple projects can cause headaches. The same way profiles keep your AWS accounts from bleeding into each other, your focus needs the same separation. So as a reminder, always focus and finish one project first before you move to other projects. Stay tuned for more blog updates and series.