Docker-based AWS CLI

aws.sh

#!/usr/bin/env bash

set -eo pipefail

[[ -n "${VERBOSE}" ]] && set -x

metadata() {
  curl -s --connect-timeout 2 --fail "http://169.254.169.254/latest/meta-data/$*"
}

role=$(metadata iam/info | jq -r .InstanceProfileArn | cut -d"/" -f2)
creds=$(metadata "iam/security-credentials/${role}")

export AWS_ACCESS_KEY_ID=$(echo $creds | jq -r .AccessKeyId)
export AWS_SECRET_ACCESS_KEY=$(echo $creds | jq -r .SecretAccessKey)
export AWS_SECURITY_TOKEN=$(echo $creds | jq -r .Token)

aws() {
  docker run --rm \
    --env=AWS_ACCESS_KEY_ID \
    --env=AWS_SECRET_ACCESS_KEY \
    --env=AWS_SECURITY_TOKEN \
    amazon/aws-cli $*
}