v6.1.0 - 2024/01/31

- FIX : If `var.profile` and `var.assume_role_arn` are used, then continuing to use `var.profile` invalidates the
  assumed role. The `aws_cli_runner.sh` now no longer uses `var.profile` when a role has been successfully assumed.
  Thank you [Garrett Blinkhorn](#11).

CHANGELOG.md

@@ -1,5 +1,10 @@
 # Changelog
 
+# v6.1.0 - 2024/01/31
+- FIX : If `var.profile` and `var.assume_role_arn` are used, then continuing to use `var.profile` invalidates the
+  assumed role. The `aws_cli_runner.sh` now no longer uses `var.profile` when a role has been successfully assumed.
+  Thank you [Garrett Blinkhorn](https://github.com/digitickets/terraform-aws-cli/issues/11).
+
 # v6.0.2 - 2024/01/31
 - FIX : Typo in `aws_cli_runner.sh` when running assuming a role. Thank you [Garrett Blinkhorn](https://github.com/digitickets/terraform-aws-cli/issues/11).
 

scripts/aws_cli_runner.sh

@@ -95,6 +95,13 @@ if [ -n "${ASSUME_ROLE_ARN}" ]; then
   export AWS_ACCESS_KEY_ID=$(jq -r '.Credentials.AccessKeyId' "$AWS_STS_JSON")
   export AWS_SECRET_ACCESS_KEY=$(jq -r '.Credentials.SecretAccessKey' "$AWS_STS_JSON")
   export AWS_SESSION_TOKEN=$(jq -r '.Credentials.SessionToken' "$AWS_STS_JSON")
+
+  ### Having assumed a role, drop the profile as that will override any credentials retrieved by the assumed role when
+  ### reused as part of the AWS CLI call.
+  ### References :
+  ### 1. https://github.com/digitickets/terraform-aws-cli/issues/11 - Thank you Garrett Blinkhorn.
+  ### 2. https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_temp_use-resources.html#using-temp-creds-sdk-cli
+  unset AWS_CLI_PROFILE_PARAM
 fi
 
 # Do we have a query?