IAM user
Add an IAM user access key, with optional MFA.
An IAM user session holds a long-lived access key in the OS keychain. With --mfa-device, Start calls STS GetSessionToken with your code and the tools receive short-lived credentials. Without MFA, the tools receive the access key, shown with a 12 hour expiry.
rolle session add iam-user --name personal --region us-west-2 --access-key-id AKIA...
# rolle prompts for the secret access key when you omit --secret-access-key
rolle start personal --mfa-code 123456| Flag | Meaning |
|---|---|
--name |
Session name |
--region |
Default region |
--access-key-id |
Access key ID |
--secret-access-key |
Secret access key. Prompted when omitted |
--mfa-device |
MFA device ARN or serial. The desktop app asks for the code on Start |
--profile |
AWS profile name. Empty uses default |
--from-profile |
Read the key of this profile in ~/.aws/credentials instead of --access-key-id |
From the credentials file
--from-profile reads the access key of a profile in ~/.aws/credentials. The session and its profile take the profile’s name. The region and mfa_serial come from the matching ~/.aws/config section. Without a region, the session takes the default region from Settings. --name, --region, --mfa-device, and --profile override these values. The key stays in the file. rolle cleanup <profile> removes it, and rolle then serves the profile.
rolle session add iam-user --from-profile personal
rolle cleanup personal