AWS cross accounts access S3 buckets


When working on AWS cross accounts S3 access, I found out that – Only s3:CreateBucket, s3:ListAllMyBuckets and s3:GetBucketLocation 3 actions are allowed to set relative-id of Resource to “*“. For all other bucket actions, you must specify a bucket name. E.g If I want to allow a user from account B to put objects into a S3 bucket in account A. Here is the steps:

1)  Create a role (RoleForAccountB) for the root of account B in account A. What it does is to tell account A to trust account B.

{
  "Version": "2012-10-17",
  "Statement": {
    "Effect": "Allow",
    "Principal": {"AWS": "arn:aws:iam::Account_B_ID:root"},
    "Action": "sts:AssumeRole"
  }
}

2) Attach policy to the role. For example, Get* and List* actions against examplebucket. Unlike S3 bucket policy, you can not specify “Principal” in the IAM role policy. It uses the one that is defined in the IAM role, which is arn:aws:iam::Account_B_ID:root in the example.

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "s3:Get*",
        "s3:List*"
      ],
      "Resource": "arn:aws:s3::examplebucket"
    }
  ]
}

 

3) Go to account B to create a policy to allow assuming the role that is created in account A then attach to the user. Something like:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": "sts:AssumeRole",
      "Resource": [
        "arn:aws:iam::Account_A_ID:role/RoleForAccountB"
      ]
    }
  ]
}

Reference:
http://docs.aws.amazon.com/AmazonS3/latest/dev/using-with-s3-actions.html
http://blogs.aws.amazon.com/security/post/TxPOJBY6FE360K/IAM-policies-and-Bucket-Policies-and-ACLs-Oh-My-Controlling-Access-to-S3-Resourc

Advertisements

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out / Change )

Twitter picture

You are commenting using your Twitter account. Log Out / Change )

Facebook photo

You are commenting using your Facebook account. Log Out / Change )

Google+ photo

You are commenting using your Google+ account. Log Out / Change )

Connecting to %s