設置IAM用戶/角色的跨賬戶訪問權限

Question

我有一個主賬戶用戶，我想允許訪問子賬戶S3存儲桶。我已經安裝了下面的堆棧在我的子賬戶

AWSTemplateFormatVersion : '2010-09-09' 
Description: 'Skynet stack to allow admin account deploying user to access S3' 

Parameters: 
    AccountId: 
    Type: String 
    Description: Account ID of admin account (containing user to allow) 
    Username: 
    Type: String 
    Description: Username to be allowed access 
    BucketPrefix: 
    Type: String 
    Description: Bucket to be allowed (prefix appended with -{AccountId}-{Region}) 

Resources: 
    CrossAccountRole: 
    Type: AWS::IAM::Role 
    Properties: 
     AssumeRolePolicyDocument: 
     Statement: 
      - Effect: Allow 
      Action: sts:AssumeRole 
      Principal: 
       AWS: 
       - !Sub arn:aws:iam::${AccountId}:user/${Username} 
     Path:/
     Policies: 
     - PolicyName: skynet-s3-delegate 
      PolicyDocument: 
      Statement: 
       - Effect: Allow 
       Action: 
        - s3:ListBucket 
        - s3:GetObject 
       Resource: "*" 

但我發現，當我嘗試承擔該角色，我仍然得到一個錯誤：

aws s3 cp skynet-lambda.zip s3://skynet-lambda-TARGET_ACCOUNT_ID-ap-southeast-1 --profile skynetci-cross-account

An error occurred (AccessDenied) when calling the AssumeRole operation: User: arn:aws:iam::MAIN_ACCOUNT_ID:user/circleci-skynet is not authorized to perform: sts:AssumeRole on resource: arn:aws:iam::TARGET_ACCOUNT_ID:role/StackSet-df0e85b0-d6fd-47bf-a0bb-CrossAccountRole-1EW45TXEFAY0D

爲什麼這麼考慮我已經對用戶有以下政策

{ 
     "Effect": "Allow", 
     "Action": [ 
      "sts:AssumeRole" 
     ], 
     "Resource": "arn:aws:iam::TARGET_ACCOUNT_ID:role/StackSet-df0e85b0-d6fd-47bf-a0bb-CrossAccountRole-1EW45TXEFAY0D" 
    } 

Answer 1

你需要有鬥策略更新，以允許跨賬戶訪問樣本政策會是這樣的：

{ 
    "Version": "2012-10-17", 
    "Statement": [ 
     { 
     "Sid": "Example permissions", 
     "Effect": "Allow", 
     "Principal": { 
      "AWS": "arn:aws:iam::AccountB-ID:root" 
     }, 
     "Action": [ 
      "s3:*" 
     ], 
     "Resource": [ 
      "arn:aws:s3:::examplebucket" 
     ] 
     } 
    ] 
} 

也使誰試圖訪問確保IAM用戶連接此內嵌政策：

{ 
    "Version": "2012-10-17", 
    "Statement": [ 
     { 
     "Sid": "Example", 
     "Effect": "Allow", 
     "Action": [ 
      "s3:*" 
     ], 
     "Resource": [ 
      "arn:aws:s3:::examplebucket" 
     ] 
     } 
    ] 
} 

你可以參考AWS Documentation

Answer 2

爲了實現你的目標，你需要設置一個桶政策在目標S3存儲桶：

{ 
    "Version": "2012-10-17", 
    "Statement": [ 
     { 
      "Sid": "DelegateS3Access", 
      "Effect": "Allow", 
      "Principal": { 
       "AWS": "arn:aws:iam::MAIN_ACCOUNT_ID:USER_NAME" 
      }, 
      "Action": "s3:*", 
      "Resource": [ 
       "arn:aws:s3:::BUCKET_NAME/*", 
       "arn:aws:s3:::BUCKET_NAME" 
      ] 
     } 
    ] 
} 

並允許此用戶使用S3權限。

{ 
    "Version": "2012-10-17", 
    "Statement": [ 
     { 
     "Sid": "Example", 
     "Effect": "Allow", 
     "Action": [ 
      "s3:*" 
     ], 
     "Resource": [ 
      "*"    
     ] 
     } 
    ] 
} 

在這種情況下，您不需要在目標帳戶上擔任角色。用戶本身將能夠訪問另一個帳戶中的存儲分區。

Answer 3

我附上了一個使用我的兩個賬戶進行測試的工作示例。

STEP 1：CloudFormation YAML模板：

AWSTemplateFormatVersion : '2010-09-09' 
Description: 'Skynet stack to allow admin account deploying user to access S3' 

Parameters: 
    AccountId: 
    Type: String 
    Description: Account ID of admin account (containing user to allow) 
    Username: 
    Type: String 
    Description: Username to be allowed access 
    BucketPrefix: 
    Type: String 
    Description: Bucket to be allowed (prefix appended with -{AccountId}-{Region}) 

Resources: 
    CrossAccountRole: 
    Type: AWS::IAM::Role 
    Properties: 
     AssumeRolePolicyDocument: 
     Statement: 
      - Effect: Allow 
      Action: sts:AssumeRole 
      Principal: 
       AWS: 
       - !Sub arn:aws:iam::${AccountId}:user/${Username} 
     Path:/
     Policies: 
     - PolicyName: skynet-s3-delegate 
      PolicyDocument: 
      Statement: 
       - Effect: Allow 
       Action: 
        - s3:ListBucket 
        - s3:GetObject 
       Resource: "*" 
    RootInstanceProfile: 
    Type: "AWS::IAM::InstanceProfile" 
    Properties: 
     Path: "/" 
     Roles: 
      - 
      Ref: "CrossAccountRole" 

第2步：創建跨帳戶配置

修改〜/ .aws /憑證。添加一個名爲「skynetci-cross-account」的新配置文件。根據您在STEP 1中創建的參數進行修改。您需要角色arn來替換下面的角色。您還需要您授予的帳戶的配置文件名稱。在這個例子中，配置文件名稱是「default」。

這裏舉例：

[skynetci-cross-account] 
role_arn = arn:aws:iam::191070ABCDEF:role/Test-CrossAccountRole-IZDDLRUMABCD 
source_profile = default 

3步：測試交叉存取

AWS --profile skynetci交賬戶S3 LS S3：//桶名稱