Skip to main content
Warning This document has not been updated for a while now. It may be out of date.
Last updated: 17 Jun 2020

govuk-aws: Bootstrap GOV.UK AWS

Follow the instructions in to request a new AWS account.

The new account has a bootstrap role that you should be able to assume to start configuring the new environment.

Setting up your work environment to assume AWS roles

There are several ways to do this


Make sure your laptop is configured with credentials to access the gds-users account. If you can login in gds-users from the command line, you should be able to get the credentials of an assumed role with the following command:

aws sts assume-role \
  --role-session-name "$(whoami)-$(date +%d-%m-%y_%H-%M)" \
  --role-arn ${role_arn} \
  --serial-number arn:aws:iam::xxxxxxx:mfa/ \
  --duration-seconds 1800 \
  --token-code ${mfa_code}

brew cask install aws-vault on macOS, or brew install aws-vault on Linux.

Follow the instructions to set up your initial profile. A good tutorial that explains this step by step can be found here:

After following the tutorial you should have an ~/.aws/config file similar to the example below.

[profile readonly]

[profile staging]
source_profile = readonly
role_arn = arn:aws:iam::11111111111:role/staging
mfa_serial = arn:aws:iam::11111111111:mfa/

After setting up aws-vault you can generate a token by running the following:

aws-vault exec environmentname -- env

Some temporary credentials will be shown in the terminal - copy the AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY and the AWS_SESSION_TOKEN.

Create a new file (e.g. aws_temp_cred) somewhere on your local machine and paste the credentials into it, so it looks similar to the example below


Then, source ./aws_temp_cred.

Setting up Terraform work environment

Follow the instructions in govuk-aws Getting Started guide to start configuring and deploying resources in the AWS environment.

Populate initial data for the new environment

In order to run the Terraform projects we will need valid data in the govuk-aws-data repository. Follow the instructions Create new environment data in that repository to create the initial environment data.

Provision the new environment

Follow the instructions in govuk-aws Environment Provisioning to provision all the components of the environment.