使用跨账户角色从账户 B 中的 EC2 实例访问账户 A 中的 S3 存储桶

Question

Introduction

• Account-A
  • There is an S3 bucket ( sample-s3-bucket-in-account-a ) in this account
  • This S3 bucket is configured with server-side encryption using AWS KMS ( SSE-KMS )
  • The AMS KMS key is aws/s3 (AWS managed key)
  • The bucket has no bucket policy
  • There is an IAM cross-account role ( sample-cross-account-role-4-s3-access-in-account-a ) created in this account
    • Account-B is the trusted entity (trust policy)
    • The permission policy allows the following actions on the S3 bucket ( sample-s3-bucket-in-account-a ):
      • s3:ListBucket
      • s3:GetBucketLocation
      • s3:GetObject
• Account-B
  • There is an EC2 instance in this account
  • There is also an IAM instance profile and role ( sample-iam-role-4-ec2-in-account-b )
  • The IAM instance profile has permission to assume the cross-account role ( sample-cross-account-role-4-s3-access-in-account-a ) created in Account-A
  • The IAM instance profile is attached to the EC2 instance

Given Facts

• I can generate temporary STS credentials on the EC2 instance in Account-B using aws sts assume-role --role-arn arn:aws:iam::[ACCOUNT-A]:role/sample-cross-account-role-4-s3-access-in-account-a --role-session-name s3-cross-account-access-session . Using these temporary STS credentials, I can list objects present in the S3 bucket in Account-A
• I can create a profile in the ~/.aws/config file and use that profile name in aws CLI to access objects present in the S3 bucket in Account-A (Reference: https://aws.amazon.com/premiumsupport/knowledge-center/s3-instance-access-bucket/ )

Problem

• I have a CodeDeploy agent running on the EC2 instance
• The CodeDeploy agent uses AWS SDK for Ruby
• The CodeDeploy agent runs using root privileges
• The CodeDeploy agent is internally generating STS credentials using the sample-iam-role-4-ec2-in-account-b instance profile/role ( http://169.254.169.254/latest/meta-data/iam/security-credentials/sample-iam-role-4-ec2-in-account-b )
• Unfortunately, these temporary STS credentials are not allowing CodeDeploy agent to download objects from the S3 bucket in Account-A
• There is an Access Denied error in the log
• I can make things work by using the S3 bucket policy but the requirement is to use a cross-account IAM role

Can anyone please tell me how I can make or configure CodeDeploy agent running in Account-B to assume sample-cross-account-role-4-s3-access-in-account-a instead of sample-iam-role-4-ec2-in-account-b ?

Answer 1

I can make things work by using the S3 bucket policy but the requirement is to use a cross-account IAM role

You can't do this, unless you write your own program which will run as part of appspec.yml . Your program would have to "manually" assume the role and get S3 object.

Otherwise, S3 bucket policy is the only why to do this.