如何从另一个AWS角色承担一个AWS角色? [英] How to assume an AWS role from another AWS role?
问题描述
我有两个AWS账户-假设A和B.
I have two AWS account - lets say A and B.
在帐户B中,我定义了一个角色,该角色允许从帐户A中访问另一个角色.我们称其为角色B
In account B, I have a role defined that allow access to another role from account A. Lets call it Role-B
{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Principal": {
"AWS": "arn:aws:iam::********:role/RoleA"
},
"Action": "sts:AssumeRole"
}]
}
在帐户A中,我定义了一个角色,该角色允许root用户承担角色.让我们称之为角色A
In account A, I have defined a role that allows the root user to assume role. Lets call it Role-A
{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Principal": {
"AWS": "arn:aws:iam::********:root"
},
"Action": "sts:AssumeRole"
}]
}
角色A具有以下政策
{
"Version": "2012-10-17",
"Statement": [
{
"Action": "sts:AssumeRole",
"Resource": "arn:aws:iam::****:role/RoleB",
"Effect": "Allow"
}]
}
作为帐户A的用户,我担任角色A.现在,使用此临时证书,我想担任角色B并访问帐户B拥有的资源.我有以下代码
As a user in account A, I assumed the Role-A. Now using this temporary credential, I want to assume the Role-B and access the resource owned by account B. I have the below code
client = boto3.client('sts')
firewall_role_object = client.assume_role(
RoleArn=INTERMEDIARY_IAM_ROLE_ARN,
RoleSessionName=str("default"),
DurationSeconds=3600)
firewall_credentials = firewall_role_object['Credentials']
firewall_client = boto3.client(
'sts',
aws_access_key_id=firewall_credentials['AccessKeyId'],
aws_secret_access_key=firewall_credentials['SecretAccessKey'],
aws_session_token=firewall_credentials['SessionToken'], )
optimizely_role_object = firewall_client.assume_role(
RoleArn=CUSTOMER_IAM_ROLE_ARN,
RoleSessionName=str("default"),
DurationSeconds=3600)
print(optimizely_role_object['Credentials'])
此代码适用于我从客户端获得的一组角色,但不适用于我在我有权访问的两个AWS账户之间定义的角色.
This code works for the set of roles I got from my client but is not working for the roles I defined between two of the AWS account I have access to.
推荐答案
终于解决了这个问题.上面的配置是正确的.该政策中有一个拼写错误.
Finally got this working. The above configuration is correct. There was a spelling mistake in the policy.
我将在此处保留此问题,因为它可能会对希望使用角色实现双跳身份验证的人有所帮助.
I will keep this question here for it may help someone who want to achieve double hop authentication using roles.
这篇关于如何从另一个AWS角色承担一个AWS角色?的文章就介绍到这了,希望我们推荐的答案对大家有所帮助,也希望大家多多支持IT屋!