通过 iam:passrole 创建 iam 用户和 aws 机密

Question

I have two iam roles,

• allaccessrole (with complete aws account access)
• limitedaccessrole (with very limited access to certain services only)

How do I utilize iam:passrole so that limitedaccessrole can utilize the permissions of allaccessrole for creating new resources(ex: a new iam user/ec2 instance)?

I added

{
"Version": "2012-10-17",
"Statement": [
    {
        "Effect": "Allow",
        "Action": "iam:PassRole",
        "Resource": "*",
        "Condition": {
            "StringEquals": {"iam:PassedToService": "iam.amazonaws.com"}
        }
    }
]

}

to limitedaccessrole 's policy but when I try creating a new user, it still says

limitedaccessrole is not authorized to perform: iam:CreateUser on resource: arn:aws:iam::myaccnumber:user/new-user-m-trying-to-create

I also tried

{
"Version": "2012-10-17",
"Statement": [
    {
        "Effect": "Allow",
        "Action": "iam:PassRole",
        "Resource": "arn:aws:sts::acc_num:role/limitedaccessrole",
        "Condition": {
            "StringEquals": {"iam:PassedToService": "iam.amazonaws.com"}
        }
    }
]

}     

This also gives me:

limitedaccessrole is not authorized to perform: iam:CreateUser on resource: arn:aws:iam::myaccnumber:user/new-user-m-trying-to-create

In short is there a way to make limitedaccessrole

• create resources (a new iam user + secrets) while utilizing a combination of IAM:Passrole and
• an existing allaccessrole (which can do everything)
• AND without giving "iam:CreateUser" permission to the limitedaccessrole .

Appreciate any inputs.
EDIT: I think I have a confused understanding of what IAM Passrole does. Looks like iam passrole is to be used when you want some service to have the same permissions as a specified role, but not when you want one role to take on the permissions of another role.

Answer 1

You want to use the sts:AssumeRole permission to accomplish what you're trying to achieve.

The workflow for this is below:

• Resource A has Role A. Role A has permission sts:AssumeRole to allow it to assume Role B.
• Resource A performs sts:AssumeRole to assume Role B. IAM key, secret key and session ID returned.
• Resource performs interaction using SDK/CLI specifying specifically the three values returned.

To summarise, when you assume a role you use the credentials returned to act as the role. It is not automatic, you could support many roles.