At the moment I don't believe we do. We just use your access key and secret key to identify you to EC2 when we make requests. We don't support using temporary credentials via Assume role For those of us wanting to know more here is AWS page <a href="http://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_create_for-user_externalid.html">http://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_create_for-user_externalid.html</a> The big internal technical limitation is that AssumeRole based access needs to be refreshed periodically (the temporary keys are good for at most 1 hour). John =:-> <div class="gmail_quote">On Mar 3, 2016 10:46 PM, "Paul Eipper" <<a href="mailto:lkraider@gmail.com">lkraider@gmail.com</a>> wrote: <blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">Hello, Does Juju work with AWS Cross Account Roles? Specifically, IAM users that need to set the "External ID" string to assume the role? AWS Cli support is enabled by configuring a profile: <a href="https://docs.aws.amazon.com/cli/latest/userguide/cli-roles.html#cli-roles-xaccount" rel="noreferrer" target="_blank">https://docs.aws.amazon.com/cli/latest/userguide/cli-roles.html#cli-roles-xaccount</a> and then specifying it on the command line: ``` aws s3 ls --profile marketingadmin ``` Is something like that supported in the Juju EC2 environment config? att, -- Paul Eipper -- Juju mailing list <a href="mailto:Juju@lists.ubuntu.com">Juju@lists.ubuntu.com</a> Modify settings or unsubscribe at: <a href="https://lists.ubuntu.com/mailman/listinfo/juju" rel="noreferrer" target="_blank">https://lists.ubuntu.com/mailman/listinfo/juju</a> </blockquote></div>