Permission Denied after mapping iam user with role

Question

Can someone help me to resolve permission denied issue. let me know if anything missing or wrong.

Created new role custom-iams-orchestration-role for service Elastic Container Service Task with below policy

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "VisualEditor0",
            "Effect": "Allow",
            "Action": [
                "sns:Publish"
            ],
            "Resource": "*"
        }
    ]
}

And trusted the user with same account by adding the below policy in role

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "",
      "Effect": "Allow",
      "Principal": {
        "Service": "ecs-tasks.amazonaws.com",
        "AWS": "arn:aws:iam::accountid:user/iams-dev-user"
      },
      "Action": "sts:AssumeRole"
    }
  ]
}

And for user iams-dev-user added below policy to assume role

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": "sts:AssumeRole",
            "Resource": "arn:aws:iam::accountid:role/custom-iams-orchestration-role"
        }
    ]
}

But getting an issue when executing aws sns publish --topic-arn arn:aws:sns:us-east-1:accountid:SISMANAGER-DEV-TOPIC --message testingForIamsDevUser --profile iams-dev-user --region=us-east-1 from my laptop with user iams-user-dev key

User:arn:aws:iam::accountid:user/iams-dev-user is not authorized to perform

Answer 1

You need to actually assume the role it doesn't happen automatically. This will give you an access key, a secret, and a session token to then use with other commands. If you dont want to assume a role then the user needs to be assigned the policy directly.

Example

Use the aws cli to assume the role in question

aws sts assume-role --role-arn arn:aws:iam::accountid:role/custom-iams-orchestration-role --role-session-name orchestration-access-example --profile iams-dev-users

This will give you ouput containing the new Access Key , Secret , and Session Token :

"Credentials": {
    "SecretAccessKey": "9drTJvcXLB89EXAMPLELB8923FB892xMFI",
    "SessionToken": "AQoXdzELDDY//////////wEaoAK1wvxJY12r2IrDFT2IvAzTCn3zHoZ7YNtpiQLF0MqZye/qwjzP2iEXAMPLEbw/m3hsj8VBTkPORGvr9jM5sgP+w9IZWZnU+LWhmg+a5fDi2oTGUYcdg9uexQ4mtCHIHfi4citgqZTgco40Yqr4lIlo4V2b2Dyauk0eYFNebHtYlFVgAUj+7Indz3LU0aTWk1WKIjHmmMCIoTkyYp/k7kUG7moeEYKSitwQIi6Gjn+nyzM+PtoA3685ixzv0R7i5rjQi0YE0lf1oeie3bDiNHncmzosRM6SFiPzSvp6h/32xQuZsjcypmwsPSDtTPYcs0+YN/8BRi2/IcrxSpnWEXAMPLEXSDFTAQAM6Dl9zR0tXoybnlrZIwMLlMi1Kcgo5OytwU=",
    "Expiration": "2016-03-15T00:05:07Z",
    "AccessKeyId": "ASIAJEXAMPLEXEG2JICEA"
}

Use these values in your credentials file:

[assumed-role]
aws_access_key_id = ASIAJEXAMPLEXEG2JICEA
aws_secret_access_key = 9drTJvcXLB89EXAMPLELB8923FB892xMFI
aws_session_token = AQoXdzELDDY//////////wEaoAK1wvxJY12r2IrDFT2IvAzTCn3zHoZ7YNtpiQLF0MqZye/qwjzP2iEXAMPLEbw/m3hsj8VBTkPORGvr9jM5sgP+w9IZWZnU+LWhmg+a5fDi2oTGUYcdg9uexQ4mtCHIHfi4citgqZTgco40Yqr4lIlo4V2b2Dyauk0eYFNebHtYlFVgAUj+7Indz3LU0aTWk1WKIjHmmMCIoTkyYp/k7kUG7moeEYKSitwQIi6Gjn+nyzM+PtoA3685ixzv0R7i5rjQi0YE0lf1oeie3bDiNHncmzosRM6SFiPzSvp6h/32xQuZsjcypmwsPSDtTPYcs0+YN/8BRi2/IcrxSpnWEXAMPLEXSDFTAQAM6Dl9zR0tXoybnlrZIwMLlMi1Kcgo5OytwU=

Use this temporary profile to execute the required command, like this:

aws sns publish --topic-arn arn:aws:sns:us-east-1:accountid:SISMANAGER-DEV-TOPIC --message testingForIamsDevUser --profile assumed-role --region=us-east-1