assume-exec.sh

#!/usr/bin/env bash
set -e

# Usage:
# ./assume-exec.sh --role-arn=<role-to-assume> \
#  --role-session-name=<name-for-session> \
#  --external-id=<external-id> -- <command-to-run>

while [ $# -gt 0 ]; do
  case "$1" in
    --role-arn=*)
      role_arn="${1#*=}"
      ;;
    --external-id=*)
      external_id="${1#*=}"
      ;;
    --role-session-name=*)
      role_session_name="${1#*=}"
      ;;
    --*)
      shift
      break
      ;;
    *)
      printf "Invalid argument $1\n"
      exit 1
  esac
  shift
done

env_string=$(aws sts assume-role \
  --role-arn ${role_arn} \
  --role-session-name ${role_session_name} \
  --external-id ${external_id} \
  | jq -r '.Credentials|[.AccessKeyId,.SecretAccessKey,.SessionToken]|"AWS_ACCESS_KEY_ID=\(.[0]) AWS_SECRET_ACCESS_KEY=\(.[1]) AWS_SECURITY_TOKEN=\(.[2])"' \
)
exec env ${env_string} $*