多个aws帐户

时间:2017-08-15 14:33:01

标签: amazon-web-services amazon-iam datadog

我有2个aws帐户,我能够使用terraform为第一个帐户设置aws集成,但是当我尝试为我的第二个帐户创建aws集成时我出错了

我已使用内联政策创建了一个角色,但我们没有设置交叉帐户。

! Datadog is not authorized to perform: sts:AssumeRole on resource: arn:aws:iam::xxxxxxxxxx:role/DatadogAWSIntegrationRole. See http://docs.datadoghq.com/integrations/aws/

信任关系:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": {
        "AWS": "arn:aws:iam::xxxxxxxxxxxx:root"
      },
      "Action": "sts:AssumeRole",
      "Condition": {
        "StringEquals": {
          "sts:ExternalId": "xxxxxxxxxxxxxxxxxxxxxxxxxx"
        }
      }
    }
  ]
}

有人可以指导我如何解决这个错误吗?

1 个答案:

答案 0 :(得分:2)

角色arn:aws:iam :: xxxxxxxxxx:role / DatadogAWSIntegrationRole还必须拥有承担其他帐户角色的权限。

您必须更新主帐户上的DatadogAWSIntegrationRole才能包含:

{
"Version": "2012-10-17",
"Statement": [
                ...
                {
                    "Effect": "Allow",
                    "Action": "sts:AssumeRole",
                    "Resource": "arn:aws:iam::xxxxxxxxxxxx:role/AssumedRoleForDataDogInOtherAccount"
                }
            ]
}