通过角色连接到 2 个不同 AWS 账户的资源

Question

Consider 2 AWS accounts A ( Other team ) and B ( Mine ) For my use case, I have to poll to queues in A's AWS account for payload and perform database operations in B. To do this, I have a role created in B having access to my databases + A's account ID as trusted relationship. Likewise A has created a role for granting access to queue in A + added B as trusted relationship.

Code for doing all the polling + database action will reside on EC2 in my account ( B ). Now how do I consume payloads and perform operations from a role's perspective. Is my understanding correct?

1. Assume role A
2. Poll to provisioning queue, get the JSON payload from SQS
3. Assume role B
4. Perform database operations in Oracle RDS
5. Assume role A
6. Return back the response to response SQS
7. Start polling again on provisioning queue SQS

FYI : I am performing the above operations using Python + Boto3

Answer 1

You don't say which programming language or SDK you are using, but essentially you can create two client/service objects, one leveraging credentials from role A and the other from role B. Then simply make API calls using the appropriate client/service object.

Using boto3, for example:

sqs_accounta = boto3.client(
    'sqs',
    region_name='us-east-1',
    aws_access_key_id=xxx,
    aws_secret_access_key=yyy,
    aws_session_token=zzz
)

rds_accountb = boto3.client(
    'rds',
    region_name='us-west-2',
    aws_access_key_id=aaa,
    aws_secret_access_key=bbb,
    aws_session_token=ccc
)

Answer 2

Instead of assuming roles, you can grant Cross-Account access to the queues in Account A to the user/role in Account B.

In your case, grant it to EC2 instance role and then you'll be able to do all the required operations from within the instance without any "Assume role" tricks.

Answer 3

Pretend for a moment that everything was happening in your own account (Account-B).

You would give a set of credentials to your code (either an IAM User or, if the code is running on an Amazon EC2 instance, you would assign an IAM Role to the instance) that it can use to access the necessary resources in Account B. So, no problem there.

The only additional requirement is that you wish to access Amazon SQS in Account-A. It so happens that you can add permissions directly to an Amazon SQS queue that grants cross-account access.

See: Basic Examples of IAM Policies for Amazon SQS - Amazon Simple Queue Service

So, you do not actually need to assume any roles . Just use the normal credentials that are assigned to your code, and add permissions to the SQS queue to allow that particular IAM User or IAM Role to use the queue.