# Assume CloudFormation AWS Roles

CloudFormation work often needs short lived role credentials before stack changes can run. This skill gives Claude, Codex, and Claude Code a repeatable AWS STS workflow for preparing those credentials.

## Install

```bash
npx skillstore add daisuke897/assume-cloudformation-role
```

## Metadata

- Status: approved
- Slug: daisuke897-assume-cloudformation-role
- Skillstore revision: r1
- Version status: missing
- Tree hash: c54ca415f2edb5ffc14116d281cab7787761f3b4a1f9e437e2daf3ca6cb0f2cd
- Author: Daisuke897
- GitHub username: Daisuke897
- License: MIT
- Repository: https://github.com/Daisuke897/dotfiles/tree/main/.github/skills/assume-cloudformation-role
- Ref: 7db9b9f06e0ab79c575b58bc48c4d8dc9849f424
- Supported tools: Claude, Codex, Claude Code
- Audit status: complete
- Agent install advisory: blocked
- Manual install advisory: allowed\_with\_warning
- Artifact signature: available
- Audit attestation: unavailable
- Human verification: not\_verified
- Risk factors: external\_commands, filesystem, env\_access
- Quality score: 38
- Quality tier: warning
- Public page: https://skillstore.pages.dev/skills/daisuke897-assume-cloudformation-role
- Manifest: https://skillstore.pages.dev/api/skills/daisuke897-assume-cloudformation-role/manifest

## Capabilities

- Shows the AWS STS assume-role command for a CloudFormation write role.
- Documents default profile, role ARN, and role session name inputs.
- Explains how to parse STS credential output with jq.
- Exports AWS\_ACCESS\_KEY\_ID, AWS\_SECRET\_ACCESS\_KEY, and AWS\_SESSION\_TOKEN for AWS CLI use.
- Lists CloudFormation create-stack, update-stack, and delete-stack examples.
- States prerequisites for AWS CLI, jq, profile configuration, and AssumeRole permission.

## Use Cases

- Prepare deployment credentials: Assume a CloudFormation write role before creating or updating a stack from the AWS CLI.
- Standardize role setup: Give a team a consistent sequence for obtaining temporary AWS credentials before stack maintenance.
- Run controlled stack cleanup: Set temporary credentials before deleting a known CloudFormation stack during maintenance.

## Prompt Templates

### Assume the default role

```
Use the assume-cloudformation-role skill with the default profile and role session name. Explain each command before I run it.
```

### Use a custom AWS profile

```
Use this skill with my AWS CLI profile named staging-admin. Keep the default role session name unless I specify another one.
```

### Prepare for a stack update

```
Assume the CloudFormation role, then help me confirm the AWS identity before I run an update-stack command.
```

### Harden the credential workflow

```
Adapt the assume-role workflow to avoid a predictable /tmp credential file and keep credentials scoped to one CloudFormation command.
```

## Limitations

- It does not validate IAM permissions before stack operations begin.
- It uses a hardcoded example role ARN and profile that may not match other AWS accounts.
- It stores credential JSON in a predictable temporary path in the documented example.
- It does not inspect or validate CloudFormation templates.

## Best Practices

- Verify the AWS account and caller identity before running stack changes.
- Use the shortest practical credential lifetime and clear environment variables after use.
- Store temporary credential files with restrictive permissions and automatic cleanup.

## Anti Patterns

- Do not reuse the hardcoded example role ARN without confirming the target account.
- Do not leave AWS\_SECRET\_ACCESS\_KEY or AWS\_SESSION\_TOKEN exported after the task finishes.
- Do not write active credentials to predictable shared paths on multi-user systems.

## Security Audit

- Audited at: 2026-07-09T01:30:46.787\+00:00
- Summary: The skill intentionally runs AWS CLI and jq commands to assume a CloudFormation write role and export temporary AWS credential variables. Most backtick detections are markdown formatting false positives, but the shell command substitution, environment variable export, shared /tmp credential file, and AWS credential directory references are real security concerns that require safer handling.

## Stats

- Views: 188
- Downloads: 8
- Favorites: 0
- Popularity score: 0