Assume AWSControlTowerExecution from management account

assume-role.sh

#!/bin/bash

export AWS_REGION="us-west-2"

account_id=$1
temp_role=$(aws sts assume-role \
                    --role-arn "arn:aws:iam::${account_id}:role/AWSControlTowerExecution" \
                    --role-session-name "aws-ct-mgmt")

unset AWS_ACCESS_KEY_ID
unset AWS_SECRET_ACCESS_KEY
unset AWS_SESSION_TOKEN

export AWS_ACCESS_KEY_ID=$(echo $temp_role | jq -r .Credentials.AccessKeyId)
export AWS_SECRET_ACCESS_KEY=$(echo $temp_role | jq -r .Credentials.SecretAccessKey)
export AWS_SESSION_TOKEN=$(echo $temp_role | jq -r .Credentials.SessionToken)

env | grep -i AWS_

To assume role, export credentials of the management account in the environment variable do:

./assume-role.sh <member-account-id>