Cross-Account Role STS Credentials Ignored about prowler

[toniblyx]

Other great catch @virtualjj! We also use STS but I wrote an internal tool that writes that credentials including the token to ~/.aws/credentials like:

[customprofile]
aws_access_key_id=YYYY
aws_secret_access_key=XXXX
aws_session_token=ZZZZ

Then you can run prowler using ./prowler -p customprofile -r us-east-1. I might add the capability to read environment variables as well in case ~/.aws/credentials is not properly configured. WDYT?

[toniblyx]

I have tested using env variables with token and it works without using --profile option so it won't work in prowler as it is now. So any custom profile has to be declared in ~/.aws/credentials

[virtualjj]

Got it thanks! As a workaround I just simply created a temporary user in the target account to perform the audit.

[toniblyx]

Cool!