Introduction

Assuming an AWS role from another AWS role involves temporary access to resources across accounts by leveraging AWS Identity and Access Management (IAM). This capability is crucial for organizations that utilize multiple AWS accounts and need to manage cross-account permissions effectively. We will explore the necessary steps, configurations, best practices, and potential pitfalls in assuming roles across AWS accounts, with technical explanations and examples.

Understanding AWS Roles and Trust Relationships

AWS roles are used to delegate access to resources without using a long-term security credential. Roles are intra-account, but they can also be configured to allow access from other accounts.

Trust Relationship

A trust relationship defines which AWS accounts can assume the role. Each role contains a policy document known as a "trust policy," which specifies the trusted entities and conditions needed to assume the role.

Session Duration

Upon assuming a role, AWS provides temporary security credentials valid for a specific duration. By default, session duration is set to one hour and can be adjusted between 15 minutes and 12 hours.

Step-by-Step: Assuming a Role from Another AWS Role

1. Preparing the Source Role

Assuming an AWS role requires three things:

• Source Role: The existing role from which you are attempting to assume another role.
• Target Role: The role you want to assume.
• Trust Policy: Policy that must allow the source role to assume the target role.

1{
2  "Version": "2012-10-17",
3  "Statement": [
4    {
5      "Effect": "Allow",
6      "Principal": {
7        "AWS": "arn:aws:iam::SourceAccountID:role/SourceRoleName"
8      },
9      "Action": "sts:AssumeRole"
10    }
11  ]
12}

2. Configuring the Target Role

Create or modify the trust relationship policy of the target role. This sets up the permission for a role from another AWS account to assume the target role.

1{
2  "Version": "2012-10-17",
3  "Statement": [
4    {
5      "Effect": "Allow",
6      "Principal": {
7        "AWS": "arn:aws:iam::SourceAccountID:role/SourceRoleName"
8      },
9      "Action": "sts:AssumeRole",
10      "Condition": {
11        "StringEquals": {
12          "sts:ExternalId": "UniqueIdentifier"
13        }
14      }
15    }
16  ]
17}

3. Assuming the Role Programmatically

Using the AWS SDK or AWS CLI, you can assume the target role by calling the sts:AssumeRole API action. Below is an example using the AWS CLI:

1aws sts assume-role \
2    --role-arn arn:aws:iam::TargetAccountID:role/TargetRoleName \
3    --role-session-name "SessionName" \
4    --external-id UniqueIdentifier

This command returns temporary security credentials (Access Key, Secret Key, and Session Token).

4. Using Temporary Credentials

Once you receive temporary security credentials, configure them in your AWS CLI environment to access resources:

export AWS_ACCESS_KEY_ID="ACCESS_KEY"
export AWS_SECRET_ACCESS_KEY="SECRET_KEY"
export AWS_SESSION_TOKEN="SESSION_TOKEN"

5. Cleanup and Best Practices

• Monitor Role Usage: Use AWS CloudTrail to monitor the roles being assumed and their usage across accounts.
• Rotate External IDs: Regularly change external IDs for enhancing security.
• Session Duration: Limit session duration based on necessity to reduce risk exposure.
• Scoped Permissions: Principle of least privilege by tightening role policies only to necessary actions and resources.

Key Points Table

Conclusion

Cross-account role assumption in AWS enhances flexibility and security postures for complex cloud architectures. By understanding and applying trust policies, secure identifications such as External IDs, and diligently monitoring, organizations can leverage cross-account access efficiently. Always adhere to best practices to ensure secure and manageable role assumptions, adapting configurations as necessary for your organization's security and operational needs.