<div style="white-space:pre-wrap">They can be refreshed prior to expiration to get equivalent immortality, example using pysdk <a href="https://gist.github.com/kapilt/ac8e222081f63ba64e93">https://gist.github.com/kapilt/ac8e222081f63ba64e93</a> Ideal usage is actually using Iam instance roles as well for instance credentials which basically work the same way wrt to refresh intervals. As perm credentials on servers violates aws best practices. </div> <div class="gmail_quote"><div dir="ltr">On Fri, Mar 4, 2016 at 12:37 AM John Meinel <<a href="mailto:john@arbash-meinel.com">john@arbash-meinel.com</a>> wrote: </div><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">At the moment I don't believe we do. We just use your access key and secret key to identify you to EC2 when we make requests. We don't support using temporary credentials via Assume role For those of us wanting to know more here is AWS page <a href="http://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_create_for-user_externalid.html" target="_blank">http://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_create_for-user_externalid.html</a> The big internal technical limitation is that AssumeRole based access needs to be refreshed periodically (the temporary keys are good for at most 1 hour). John =:-> <div class="gmail_quote">On Mar 3, 2016 10:46 PM, "Paul Eipper" <<a href="mailto:lkraider@gmail.com" target="_blank">lkraider@gmail.com</a>> wrote: <blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">Hello, Does Juju work with AWS Cross Account Roles? Specifically, IAM users that need to set the "External ID" string to assume the role? AWS Cli support is enabled by configuring a profile: <a href="https://docs.aws.amazon.com/cli/latest/userguide/cli-roles.html#cli-roles-xaccount" rel="noreferrer" target="_blank">https://docs.aws.amazon.com/cli/latest/userguide/cli-roles.html#cli-roles-xaccount</a> and then specifying it on the command line: ``` aws s3 ls --profile marketingadmin ``` Is something like that supported in the Juju EC2 environment config? att, -- Paul Eipper -- Juju mailing list <a href="mailto:Juju@lists.ubuntu.com" target="_blank">Juju@lists.ubuntu.com</a> Modify settings or unsubscribe at: <a href="https://lists.ubuntu.com/mailman/listinfo/juju" rel="noreferrer" target="_blank">https://lists.ubuntu.com/mailman/listinfo/juju</a> </blockquote></div> -- Juju mailing list <a href="mailto:Juju@lists.ubuntu.com" target="_blank">Juju@lists.ubuntu.com</a> Modify settings or unsubscribe at: <a href="https://lists.ubuntu.com/mailman/listinfo/juju" rel="noreferrer" target="_blank">https://lists.ubuntu.com/mailman/listinfo/juju</a> </blockquote></div>