# Sample Serverless.yml for multiple AWS accounts needed! **URL:** \ **Category:** Serverless Framework\ **Created:** [March 21, 2017, 8:37am UTC](https://forum.serverless.com/t/sample-serverless-yml-for-multiple-aws-accounts-needed/1528 "2017-03-21T08:37:40Z")\ **Posts on this page:** 14\ **Page:** 1
**Author:** ![mwawrusch](https://yyz2.discourse-cdn.com/flex036/user_avatar/forum.serverless.com/mwawrusch/32/528_2.png) [@mwawrusch](https://forum.serverless.com/u/mwawrusch)\ **Post date:** [March 21, 2017, 8:37am UTC](https://forum.serverless.com/t/sample-serverless-yml-for-multiple-aws-accounts-needed/1528/1 "2017-03-21T08:37:40Z")
I need to set up deployment of production to a different AWS account. What’s the best/correct way to configure serverless.yml? ---
**Author:** ![buggy](https://yyz2.discourse-cdn.com/flex036/user_avatar/forum.serverless.com/buggy/32/177_2.png) [@buggy](https://forum.serverless.com/u/buggy)\ **Post date:** [March 21, 2017, 11:03am UTC](https://forum.serverless.com/t/sample-serverless-yml-for-multiple-aws-accounts-needed/1528/2 "2017-03-21T11:03:15Z")
The easiest solution is to make sure you don’t have a profile specified in your `serverless.yml` then set the `AWS_PROFILE` environment variable to the profile from your `~/.aws/credentials` file that you want to use. For example: `AWS_PROFILE=prod sls deploy -s prod` ---
**Author:** ![rowanu](https://yyz2.discourse-cdn.com/flex036/user_avatar/forum.serverless.com/rowanu/32/75_2.png) [@rowanu](https://forum.serverless.com/u/rowanu)\ **Post date:** [March 21, 2017, 11:05pm UTC](https://forum.serverless.com/t/sample-serverless-yml-for-multiple-aws-accounts-needed/1528/3 "2017-03-21T23:05:30Z")
Yep, profiles for the win. You can even configure your profiles to use cross-account roles, as described in [the docs](http://docs.aws.amazon.com/cli/latest/userguide/cli-roles.html#cli-roles-xaccount). ---
**Author:** ![sdeby](https://avatars.discourse-cdn.com/v4/letter/s/848f3c/32.png) [@sdeby](https://forum.serverless.com/u/sdeby)\ **Post date:** [March 23, 2017, 7:45pm UTC](https://forum.serverless.com/t/sample-serverless-yml-for-multiple-aws-accounts-needed/1528/4 "2017-03-23T19:45:03Z")
Hey guys, Sorry for the late post. Is this actually working for you? We have a cross-account setup but I ended up having to resort to some other tricks to get this to work. Passing the AWS profile as environment variable works fine with regular AWS cli and other tools. Here is sample error message I get: ```auto AWS_PROFILE=dev-user-role serverless deploy Serverless Error --------------------------------------- AWS provider credentials not found. You can find more info on how to set up provider credentials in our docs here: https://git.io/vXsdd Get Support -------------------------------------------- Docs: docs.serverless.com Bugs: github.com/serverless/serverless/issues Your Environment Information ----------------------------- OS: darwin Node Version: 6.10.0 Serverless Version: 1.9.0 ``` My setup looks like this (redacted of course): Sample cross-account settings for Dev vs Staging environments: ### ~/.aws/credentials ```auto [mgmt] aws_access_key_id = AAAA aws_secret_access_key = BBB region = us-west-2 ``` ### ~/.aws/config ```auto [profile dev-user-role] role_arn = arn:aws:iam::<>:role/user-role source_profile = mgmt output = json region = us-west-2 [profile stg-user-role] role_arn = arn:aws:iam::<>:role/user-role source_profile = mgmt output = json region = us-west-2 ``` Thanks. Serge ---
**Author:** ![rowanu](https://yyz2.discourse-cdn.com/flex036/user_avatar/forum.serverless.com/rowanu/32/75_2.png) [@rowanu](https://forum.serverless.com/u/rowanu)\ **Post date:** [March 23, 2017, 9:03pm UTC](https://forum.serverless.com/t/sample-serverless-yml-for-multiple-aws-accounts-needed/1528/5 "2017-03-23T21:03:29Z")
Ah, sorry about that @sdeby! I have had problems doing the cross-account role, and wrote a wrapper script to make it work - I really should’ve mentioned that. Here’s the script I mentioned in another post: [http://forum.serverless.com/t/problems-deploying-using-a-cross-account-role-in-aws/1493/2?u=rowanu](http://forum.serverless.com/t/problems-deploying-using-a-cross-account-role-in-aws/1493/2?u=rowanu) ---
**Author:** ![buggy](https://yyz2.discourse-cdn.com/flex036/user_avatar/forum.serverless.com/buggy/32/177_2.png) [@buggy](https://forum.serverless.com/u/buggy)\ **Post date:** [March 24, 2017, 1:31am UTC](https://forum.serverless.com/t/sample-serverless-yml-for-multiple-aws-accounts-needed/1528/6 "2017-03-24T01:31:42Z")
> [@sdeby](#): > > Passing the AWS profile as environment variable works fine with regular AWS cli and other tools. My understanding is that the environment variables are used by the SDK which underpins both the AWS CLI tools and the Serverless Framework. I know they work with Serverless if you’re referencing a profile in `~/.aws/credentials` but I’ve never tried it with cross-across roles. ---
**Author:** ![ryan-dyer-sp](https://avatars.discourse-cdn.com/v4/letter/r/ecb155/32.png) [@ryan-dyer-sp](https://forum.serverless.com/u/ryan-dyer-sp)\ **Post date:** [March 24, 2017, 7:19pm UTC](https://forum.serverless.com/t/sample-serverless-yml-for-multiple-aws-accounts-needed/1528/7 "2017-03-24T19:19:49Z")
Personally we do the following: ``` custom: defaultStage: dev profiles: dev: dev prod: prod test: dev provider: stage: ${opt:stage, self:custom.defaultStage} region: us-east-1 profile: ${self:custom.profiles.${self:provider.stage}} ``` Setup multiple AWS accounts as others above have mentioned and then you just need to specify the stage and it automatically will select the correct profile to use; dev and test use our dev acc, prod the prod account. Tailor as you see fit, Ryan ---
**Author:** ![menocomp](https://yyz2.discourse-cdn.com/flex036/user_avatar/forum.serverless.com/menocomp/32/1848_2.png) [@menocomp](https://forum.serverless.com/u/menocomp)\ **Post date:** [September 13, 2017, 6:59am UTC](https://forum.serverless.com/t/sample-serverless-yml-for-multiple-aws-accounts-needed/1528/8 "2017-09-13T06:59:43Z")
Hey @rowanu, I have been trying to deploy my serverless lambda in production account the same as I did in dev account but it failed for the past 2-3 hours. I tried the different ways described in documentation [https://serverless.com/framework/docs/providers/aws/guide/serverless.yml](https://serverless.com/framework/docs/providers/aws/guide/serverless.yml) I tried (using-the-aws-profile-option) and (Per Stage Profiles) but both did not work. But finally I sorted it out. the reason is I am accessing my prod account via roles not via user accounts. The link you provided [http://docs.aws.amazon.com/IAM/latest/UserGuide/id\_roles\_use\_switch-role-cli.html](http://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_use_switch-role-cli.html) will add the profile associated to the prod role in this file .aws/config while serverless apparently only checking .aws/credentials (correct me if I am wrong). The fix was simply adding the role profile in .aws/credentials file as follow: ```auto [prodaccess] role_arn = [role arn here] source_profile = default ``` This will make both AWS CLI and serverless CLI be able to run/deploy onto the prod by specifying the role as follows: aws cli =\> aws iam list-users --profile prodaccess serverless cli =\> sls deploy -s prod --aws-profile prodaccess Hope this saves someone time. Thanks for sharing ideas and for your time. ---
**Author:** ![rowanu](https://yyz2.discourse-cdn.com/flex036/user_avatar/forum.serverless.com/rowanu/32/75_2.png) [@rowanu](https://forum.serverless.com/u/rowanu)\ **Post date:** [September 14, 2017, 4:32am UTC](https://forum.serverless.com/t/sample-serverless-yml-for-multiple-aws-accounts-needed/1528/9 "2017-09-14T04:32:07Z")
Thanks for sharing this. I’ve been bitten by the `config` vs `credentials` thing in the past. I think that roles are only supported in `config` (because they depend on a `source_profile`, as you’ve mentioned (i.e. it’s an SDK thing, not a Serverless thing). ---
**Author:** ![igorkosta](https://yyz2.discourse-cdn.com/flex036/user_avatar/forum.serverless.com/igorkosta/32/1395_2.png) [@igorkosta](https://forum.serverless.com/u/igorkosta)\ **Post date:** [December 13, 2017, 9:39am UTC](https://forum.serverless.com/t/sample-serverless-yml-for-multiple-aws-accounts-needed/1528/10 "2017-12-13T09:39:58Z")
Hi @menocomp , I just wanted to say thank you! 🙂 I spent like 3 hours pulling my hair out. Cheers, Igor ---
**Author:** ![Prashant](https://avatars.discourse-cdn.com/v4/letter/p/51bf81/32.png) [@Prashant](https://forum.serverless.com/u/Prashant)\ **Post date:** [January 19, 2018, 12:52am UTC](https://forum.serverless.com/t/sample-serverless-yml-for-multiple-aws-accounts-needed/1528/11 "2018-01-19T00:52:47Z")
I tried same steps mentioned by menocomp, but getting Serverless: Deployment failed! Serverless Error --------------------------------------- An error occurred while provisioning your stack: XXXXXXXLambdaFunction - **Cross-account pass role is not allowed…** zip files are getting copied in S3 in prod account, Also noticed S3 -Server side encryption - Access denied while checking the file permissions. Which is not allowing to deploy. Can someone please guide on this. ---
**Author:** ![Vadorequest-SL](https://yyz2.discourse-cdn.com/flex036/user_avatar/forum.serverless.com/vadorequest-sl/32/1630_2.png) [@Vadorequest-SL](https://forum.serverless.com/u/Vadorequest-SL)\ **Post date:** [August 12, 2018, 7:16pm UTC](https://forum.serverless.com/t/sample-serverless-yml-for-multiple-aws-accounts-needed/1528/12 "2018-08-12T19:16:27Z")
I’ve had to read both @menocomp answer and the AWS doc to figure it out, but here is a full working example for those interested! This setup is to configure one **profile** named `development`, which will work whether it’s executed from `aws` CLI command or `sls` CLI command. This is assuming that you want to setup a cross-account access, by providing a `role_arn` to the aws configuration. `~/.aws/config` ```auto [profile development] output = json region = eu-west-1 role_arn = your-arn source_profile = development ``` * * * `~/.aws/credentials` ```auto [development] # Necessary for both AWS CLI and SLS aws_access_key_id = your-aws_access_key_id aws_secret_access_key = your-aws_secret_access_key # Necessary for SLS, because SLS doesn't do a lookup in the ./config file role_arn = your-arn source_profile = development ``` * * * With this setup: - `sls deploy --aws-profile development` will work - `aws iam list-users --profile development` will output something similar to: ```json { "Users": [] } ``` If you remove the `role_arn` and `source_profile` from `~/.aws/credentials`, you’ll notice it may still work _(depending on your permissions, doesn’t work at all in my case because my IAM user doesn’t have any permission on the root account)_, but you won’t hit the same account (you’ll hit the root account, not the cross-account) Thanks for your input @menocomp, definitely saved me a lot of time! 🙂 ---
**Author:** ![bishwash-devops](https://yyz2.discourse-cdn.com/flex036/user_avatar/forum.serverless.com/bishwash-devops/32/3184_2.png) [@bishwash-devops](https://forum.serverless.com/u/bishwash-devops)\ **Post date:** [March 27, 2019, 2:57am UTC](https://forum.serverless.com/t/sample-serverless-yml-for-multiple-aws-accounts-needed/1528/13 "2019-03-27T02:57:06Z")
I wanted to use as environment variable instead of having to pass the profile flag each time… So I updated ~/.bash\_profile with, alias sls=“sls --aws-profile $AWS\_DEFAULT\_PROFILE” Now if I do export and run sls it’s much easier, and obviously that exported profile name needs to be in the credentials file. ---
**Author:** ![jayair](https://yyz2.discourse-cdn.com/flex036/user_avatar/forum.serverless.com/jayair/32/397_2.png) [@jayair](https://forum.serverless.com/u/jayair)\ **Post date:** [August 6, 2019, 10:51pm UTC](https://forum.serverless.com/t/sample-serverless-yml-for-multiple-aws-accounts-needed/1528/14 "2019-08-06T22:51:56Z")
I just wanted to share that we’ve written about this pattern in detail. I know we are late to the party but hopefully somebody finds it useful! - [Why deploy your Serverless app into multiple AWS accounts?](https://seed.run/blog/why-deploy-your-serverless-app-into-multiple-aws-accounts) - [How to deploy your Serverless app into multiple AWS accounts](https://seed.run/blog/how-to-deploy-your-serverless-app-into-multiple-aws-accounts) Let me know if we should go into further detail for anything.