3

Assuming we have two AWS acounts: Account-A, Account-B and an ec2 instance running on AccountA.

aws ec2 describe-instances works as expected for the instance's own account without an ~/.aws/credentials file with an instance role.

My goal is to run aws ec2 describe-instances for Account-B from this instance.

The following command works and outputs credentials:

$ aws sts assume-role --role-arn arn:aws:iam::012345678901:role/accountb-role --role-session-name test

However, this does not:

$ aws ec2 describe-instances --profile AccountB

'aws_access_key_id'

~/.aws/config

[default]
region = us-east-1

[profile AccountB]
role_arn = arn:aws:iam::012345678901:role/accountb-role
source_profile = default

As I mentioned, ~/.aws/credentials does not exist as the instance uses an instance role for IAM.

accountb-role Trust Relationship Policy

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": {
        "Service": "lambda.amazonaws.com"
      },
      "Action": "sts:AssumeRole"
    },
    {
      "Effect": "Allow",
      "Principal": {
        "AWS": "arn:aws:iam::012345678900:role/accounta-role"
      },
      "Action": "sts:AssumeRole"
    }
  ]
}

instance inline policy

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "Stmt1490625590000",
            "Effect": "Allow",
            "Action": [
                "sts:AssumeRole"
            ],
            "Resource": [
                "arn:aws:iam::012345678901:role/accountb-role"
            ]
        }
    ]
}

Both the accounta-role instance role and accountb-role also have the stock ReadOnlyAccess IAM policy attached.

  • What is the error message when you try to run the describe-instances with the profile switch? – strongjz May 31 '17 at 16:17
  • 'aws_access_key_id' is the error message, nothing else – Lightbeard Jun 15 '17 at 14:35
3

If anyone is still interested in the answer, you have to save the aws credentials to be able to use AccountB between these calls:

aws sts assume-role --role-arn arn:aws:iam::012345678901:role/accountb-role --role-session-name test

<< save aws_access_key_id, aws_secret_access_key, AWS_SESSION_TOKEN here>>

You then call

aws configure --profile AccountB 

to make sure you have them set up. also, can AWS_SESSION_TOKEN expire after some time

aws ec2 describe-instances --profile AccountB

This article explains in detail

0

In your IAM panel there is also the ability to grant access to a cross-account IAM user, which is what it sounds like you're looking for.

http://docs.aws.amazon.com/IAM/latest/UserGuide/tutorial_cross-account-with-roles.html

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.