Hello. I'm creating a testing stack for a group of 10 dynamically generated IAM users. I started out from this example: https://github.com/outerbounds/metaflow-tools/tree/master/aws/terraform/metaflow. What is the cleanest way to add those IAM users permission to run everything configured by Metaflow? I know there is probably an easy way but currently I don't see any other than adding permission to assume the metaflow_user_role to all users one by one. Is there a cleaner way?

You can create an AWS IAM Group that allows users to AssumeRole to the metaflow_user_role. Then you add each user to the group.

+1 you can add the iam group to the role's trust policy and then add each IAM user to the group as they get created.

Shouldnt I rather add the policies directly to the group? I want them to have the permissions to operate the stack permanently.

Using an AssumeRole allows you to provide temporary security credentials instead of IAM users with access keys that need to be rotated.

The users are beginners and it is hard for them to assume the role. Is there an integrated way in metaflow to assume the role simply? Can I write something like:

@environment(METAFLOW_ASSUME_ROLE="role_arn")

? Or do I need to force the users to run the commands to assume the roles and alter their credentials file (based on the roles access information)?

I use aws-vault for this, you can set it up whereby users would only have to run

aws-vault exec PROFILE -— python flow.py

. Users would have to pass in an MFA token ever(max duration the temporary credentials last is 24 hours) so often depending on your IAM group settings.