允许从 Amazon EC2 实例跨账户访问 Amazon S3 存储桶

Question

I have S3 bucket "cross-bucket" in Account say B.Now i want EC2 which is present in Account A to access this bucket "cross-bucket" in Account B.

I need to achieve this using IAM roles as we are not allowed to create users.

I have used below template to create role in Account B

 AWSTemplateFormatVersion : '2010-09-09'
 Description: 'Cross account role for S3'

 Parameters:
   AccountId:
   Type: String
   Description: Account ID of admin account (containing user to allow)

 Resources:
 CrossAccountRole:
Type: AWS::IAM::Role
Properties:
  AssumeRolePolicyDocument:
    Statement:
      - Effect: Allow
        Action: sts:AssumeRole
        Principal:
          AWS:
            - !Sub arn:aws:iam::${AccountId}:root
  Path: /
  Policies:
    - PolicyName: my-s3-delegate
      PolicyDocument:
        Statement:
          - Effect: Allow
            Action:
              - s3:ListBucket
              - s3:GetObject
            Resource: "*"
  RootInstanceProfile: 
Type: "AWS::IAM::InstanceProfile"
Properties: 
  Path: "/"
  Roles: 
      - 
        Ref: "CrossAccountRole"
    

After creating this role how should i attach this to instance present in Account A? Or i am missing something here?

Answer 1

After creating this role how should i attach this to instance present in Account A?

You are not attaching it to an instance in Acc A. Instead, you create an instance role in Acc A. The role will have permissions to assume the role from Acc B.

Thus, the instance role would have a policy similar to the following one:

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "VisualEditor0",
            "Effect": "Allow",
            "Action": "sts:AssumeRole",
            "Resource": "<ARN-of-ROLE-in-ACC-B>"
            }
        }
    ]
}

Then any application running on the instance would have to use sts assume-role to actually assume the role and perform actions in Acc B.

Answer 2

Your situation is:

• Amazon EC2 instance in Account-A
• Amazon S3 bucket in Account-B
• You would like to allow the EC2 instance to access the bucket

There are two ways to do this:

Option 1: Bucket Policy

Simply add a bucket policy to the bucket in Account-B that grants access to the IAM Role used by the EC2 instance:

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Action": [
                "s3:GetObject",
                "s3:ListBucket"
            ],
            "Effect": "Allow",
            "Resource": [
                "arn:aws:s3:::my-bucket",
                "arn:aws:s3:::my-bucket/*"
            ],
            "Principal": {
                "AWS": [
                    "arn:aws:iam::ACCOUNT-A:role/my-ec2-role"
                ]
            }
        }
    ]
}

The EC2 instance will use its normal IAM Role credentials to access the bucket. Also make sure the IAM Role has given permission to use Amazon S3 to access the bucket:

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "s3:GetObject",
                "s3:ListBucket"
            ],
            "Resource": [
                "arn:aws:s3:::bucket-b",
                "arn:aws:s3:::bucket-b/*"
            ]
        }
    ]
}

Option 2: Assume Role

• Create an IAM Role in Account-B that has permission to access the bucket
• Code on the EC2 instance calls AssumeRole() on the IAM Role
• Use the returned credentials to access the bucket