create-role.sh

#!/bin/bash

# Generate a random 6-character external ID
external_id=$(cat /dev/urandom | tr -dc 'a-zA-Z0-9' | fold -w 6 | head -n 1)

# Create a trust policy file
cat <<EOT > trust-policy.json
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": {
        "AWS": "arn:aws:iam::184307404691:user/datagran-aws-user"
      },
      "Action": "sts:AssumeRole",
      "Condition": {
        "StringEquals": {
          "sts:ExternalId": "$external_id"
        }
      }
    }
  ]
}
EOT

# Create the role with the trust policy
aws iam create-role --role-name S3ReadRole --assume-role-policy-document file://trust-policy.json

# Attach the S3 read-only policy to the role
aws iam attach-role-policy --role-name S3ReadRole --policy-arn arn:aws:iam::aws:policy/AmazonS3ReadOnlyAccess

# Clean up the trust policy file
rm trust-policy.json

# Output the external ID
echo "The external ID for the role is: $external_id"