title: Role Switching ( assume role ) with AWS and Terraform
body: <p><strong>Background:</strong></p>
  
  <p>We've started a spike investigation into generating infrastructure using Terraform rather than directly with Cloudformation. </p>
  
  <p>We have multiple AWS accounts which are separated for Live, QA and Dev environments ( complete separation of concerns due to the complexity of stacks and the potential for catastrophic destruction of client services ). Our accounts have MFA switched on.</p>
  
  <p>With Cloudformation we undertake role switching to authenticate against one primary AWS account and then stand up our stacks in the correct account using an assumed role.</p>
  
  <p><strong>The crux of the question:</strong></p>
  
  <p>Is this possible ( without massive dirty hacks, please! ) in Terraform? We have been attempting this process but suffer the following error when trying to run Terraform Plan or Build </p>
  
  <p><code>" The role ' arn:aws:iam::ACCOUNTID:role/ASSUMEDROLE" cannot be assumed.'</code> </p>
  
  <p>Our provider switching code is:</p>
  
  <pre><code># Configure the AWS Provider
  provider "aws" {
    region = "${var.aws_region}"
    profile = "${var.profile}"
    assume_role {
      role_arn = "arn:aws:iam::${lookup(var.aws_account_id, var.tag_environment)}:role/MYASSUMEROLE"
    }
  }
  </code></pre>
  
  <p>From hours of Googling, reading through blog posts and Terraform's open bug list, this seems to be something that isn't supported yet?</p>
  
  <p>We've seen that at least one person is creating shell scripts to try and do the authentication and then pass-through. This seems a really ugly hack to make it work.</p>
  
  <p><strong><em>Has anyone actually got this working with MFA turned on with the accounts?</em></strong></p>
  
  <p>We've had extremely vague responses from the team at HashiCorp when talking at Cons and workshops.</p>