Cross-Account Access to Amazon S3 using STS:AssumeRole

Introduction

Amazon Simple Storage Service (S3) is a widely-used object storage service offered by Amazon Web Services (AWS). It provides secure, durable, and scalable storage for various types of data. In some scenarios, we may need to grant access to our S3 buckets to AWS accounts that are different from the one where the bucket resides. This is where cross-account access comes into play, and AWS Security Token Service (STS) with the AssumeRole API becomes the key mechanism to securely share data across accounts. In this guide, we will explore the steps to set up cross-account access to S3 using the sts:AssumeRole mechanism.

Step-by-Step Guide

1. Creating the IAM Role in the Destination Account:
2. Sign in to the AWS Management Console of the destination account.
3. Navigate to the IAM (Identity and Access Management) service. Create a new IAM role with the necessary permissions for accessing S3.
4. Define a trust policy that specifies the source AWS account(s) allowed to assume this role using the sts:AssumeRole API.

{
"Version": "2012-10-17",
"Statement": {
    "Effect": "Allow",
    "Principal": {
        "AWS": "arn:aws:iam::ACCOUNT_SOURCE_ID:root"
    }
    "Action": "sts:AssumeRole",
    "Condition": {
        "StringEquals": {
            "sts:ExternalId": "EXTERNAL_ID"
            }
        }
    }
}

• Attach the desired permissions policy that grants access to the specific S3 bucket(s).

{
"Version": "2012-10-17",
"Statement": {
    "Effect": "Allow",
    "Action": "s3:*",
    "Resource": "*"
    }
}

1. Assuming the IAM Role in the Source Account:
2. Sign in to the AWS Management Console of the source account. Navigate to the IAM service.
3. Create a new IAM user or use an existing one to assume the role in the destination account.
4. Attach the necessary permissions to the IAM user or group to allow assuming the role.

{
"Version": "2012-10-17",
"Statement": {
    "Effect": "Allow",
    "Action": [
        "iam:ListRoles",
        "sts:AssumeRole",
    ],
    "Resource": "*"
    }
}

1. Assuming the Role Programmatically:
2. Use the AWS SDK or AWS CLI in the source account to assume the IAM role in the destination account.
3. Specify the RoleArn **of the IAM role, the **RoleSessionName to identify the session, and optionally, an ExternalId for additional security.
4. The AssumeRole operation returns temporary security credentials consisting of an AccessKeyId, SecretAccessKey, SessionToken, and Expiration.

aws sts assume-role --role-arn "arn:aws:iam::ACCOUNT_DESTINATION_ID:role/TRUST_POLICY_ROLE_NAME_IN_ACCOUNT_DESTINATION" --role-session-name SESSION_NAME --external-id EXTERNAL_ID

1. Accessing the S3 Bucket in the Destination Account:
2. Use the temporary security credentials obtained after assuming the role to access the S3 bucket in the destination account.
3. Configure our AWS SDK or AWS CLI to use the temporary credentials when making S3 API requests.

4. These credentials have the necessary permissions as defined in the IAM role's permissions policy.

5. Testing and Verifying Access:

6. Perform tests to ensure that the cross-account access is working as expected.

7. Use the AWS CLI or SDKs to list, upload, or download objects from the S3 bucket.

8. Verify that the access control policies on the S3 bucket are correctly configured to allow the assumed role.

FAQ

Q: What is the benefit of using sts:AssumeRole for cross-account access?

A: The sts:AssumeRole mechanism allows us to grant temporary access to another AWS account without sharing long-term credentials, enhancing security and reducing the attack surface.
Q: Can I restrict the duration of the assumed role's access?

A: Yes, we can define an expiration time for the temporary credentials obtained through sts:AssumeRole, ensuring limited access to the destination account.
Q: Are there any additional costs associated with cross-account access to S3?

A: No, there are no additional costs

Conclusion

Cross-account access to Amazon S3 using the sts:AssumeRole mechanism provides a secure and efficient way to share data between AWS accounts. By leveraging IAM roles and the Security Token Service, we can grant temporary access to S3 buckets without sharing long-term credentials. This approach enhances security and allows for fine-grained control over access permissions. Whether we need to collaborate with external partners, consolidate data from multiple accounts, or implement multi-tier architectures, the sts:AssumeRole mechanism simplifies cross-account access and empowers us to utilize the full potential of AWS cloud storage.