# Problems deploying using a cross-account role in AWS

**URL:** <https://forum.serverless.com/t/problems-deploying-using-a-cross-account-role-in-aws/1493>\
**Category:** Serverless Framework\
**Tags:** aws\
**Created:** [March 15, 2017, 4:17pm UTC](https://forum.serverless.com/t/problems-deploying-using-a-cross-account-role-in-aws/1493 "2017-03-15T16:17:38Z")\
**Posts on this page:** 1\
**Showing post:** 2

<div class="post-metadata">

**Author:** ![rowanu](https://yyz2.discourse-cdn.com/flex036/user_avatar/forum.serverless.com/rowanu/32/75_2.png) [@rowanu](https://forum.serverless.com/u/rowanu)\
**Post date:** [March 19, 2017, 9:07pm UTC](https://forum.serverless.com/t/problems-deploying-using-a-cross-account-role-in-aws/1493/2 "2017-03-19T21:07:02Z")

</div>

The issue is that pass role is not intended to change accounts, just limit the permissions used when deploying (to a specific role).

You should be able to specify a profile that uses a cross-account role (see the [CLI docs for more detail](http://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_use_switch-role-cli.html)), _as long as you don’t require MFA_.

If you need MFA (like I do), you’ll need to do a “manual” STS assume role to set my local environment variables. The STS command is relatively quick, so I’ve just been wrapping my commands with this script (which requires [`jq`](https://stedolan.github.io/jq/)):

```bash
#!/bin/bash

CREDS=$(aws sts assume-role --role-arn \
  <YOUR_ROLE_ARN> \
  --role-session-name my-sls-session --out json)
export AWS_ACCESS_KEY_ID=$(echo $CREDS | jq -r '.Credentials.AccessKeyId')
export AWS_SECRET_ACCESS_KEY=$(echo $CREDS | jq -r '.Credentials.SecretAccessKey')
export AWS_SESSION_TOKEN=$(echo $CREDS | jq -r '.Credentials.SessionToken')

echo $@
$@

```

This assumes the role you want to use, and runs the command you passed it (it’s not actually SLS specific) e.g. `./script.sh sls deploy`.

---

_[View the full topic](https://forum.serverless.com/t/problems-deploying-using-a-cross-account-role-in-aws/1493)._