Question

我有一个主帐户用户，我想允许访问子帐户S3存储桶。我在子帐户中设置了以下堆栈

AWSTemplateFormatVersion : '2010-09-09'
Description: 'Skynet stack to allow admin account deploying user to access S3'

Parameters:
  AccountId:
    Type: String
    Description: Account ID of admin account (containing user to allow)
  Username:
    Type: String
    Description: Username to be allowed access
  BucketPrefix:
    Type: String
    Description: Bucket to be allowed (prefix appended with -{AccountId}-{Region})

Resources:
  CrossAccountRole:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Statement:
          - Effect: Allow
            Action: sts:AssumeRole
            Principal:
              AWS:
                - !Sub arn:aws:iam::${AccountId}:user/${Username}
      Path: /
      Policies:
        - PolicyName: skynet-s3-delegate
          PolicyDocument:
            Statement:
              - Effect: Allow
                Action:
                  - s3:ListBucket
                  - s3:GetObject
                Resource: "*"

但是我发现当我尝试扮演角色时仍然会出错：

aws s3 cp skynet-lambda.zip s3://skynet-lambda-TARGET_ACCOUNT_ID-ap-southeast-1 --profile skynetci-cross-account

An error occurred (AccessDenied) when calling the AssumeRole operation: User: arn:aws:iam::MAIN_ACCOUNT_ID:user/circleci-skynet is not authorized to perform: sts:AssumeRole on resource: arn:aws:iam::TARGET_ACCOUNT_ID:role/StackSet-df0e85b0-d6fd-47bf-a0bb-CrossAccountRole-1EW45TXEFAY0D

为什么这样考虑我已经为用户提供了以下政策

    {
        "Effect": "Allow",
        "Action": [
            "sts:AssumeRole"
        ],
        "Resource": "arn:aws:iam::TARGET_ACCOUNT_ID:role/StackSet-df0e85b0-d6fd-47bf-a0bb-CrossAccountRole-1EW45TXEFAY0D"
    }

Answer 1

您需要更新Bucket Policy以允许跨帐户访问，示例政策如下：

{
   "Version": "2012-10-17",
   "Statement": [
      {
         "Sid": "Example permissions",
         "Effect": "Allow",
         "Principal": {
            "AWS": "arn:aws:iam::AccountB-ID:root"
         },
         "Action": [
            "s3:*"
         ],
         "Resource": [
            "arn:aws:s3:::examplebucket"
         ]
      }
   ]
}

还要确保尝试访问的IAM用户附加了此内联策略：

{
   "Version": "2012-10-17",
   "Statement": [
      {
         "Sid": "Example",
         "Effect": "Allow",
         "Action": [
            "s3:*"
         ],
         "Resource": [
            "arn:aws:s3:::examplebucket"
         ]
      }
   ]
}

您可以参考AWS Documentation

Answer 2

我附上了一个我用我的两个帐户测试的工作示例。

第1步：CloudFormation YAML模板：

AWSTemplateFormatVersion : '2010-09-09'
Description: 'Skynet stack to allow admin account deploying user to access S3'

Parameters:
  AccountId:
    Type: String
    Description: Account ID of admin account (containing user to allow)
  Username:
    Type: String
    Description: Username to be allowed access
  BucketPrefix:
    Type: String
    Description: Bucket to be allowed (prefix appended with -{AccountId}-{Region})

Resources:
  CrossAccountRole:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Statement:
          - Effect: Allow
            Action: sts:AssumeRole
            Principal:
              AWS:
                - !Sub arn:aws:iam::${AccountId}:user/${Username}
      Path: /
      Policies:
        - PolicyName: skynet-s3-delegate
          PolicyDocument:
            Statement:
              - Effect: Allow
                Action:
                  - s3:ListBucket
                  - s3:GetObject
                Resource: "*"
  RootInstanceProfile: 
    Type: "AWS::IAM::InstanceProfile"
    Properties: 
      Path: "/"
      Roles: 
          - 
            Ref: "CrossAccountRole"

第2步：创建跨账户资料

修改〜/ .aws /凭证。添加一个名为“skynetci-cross-account”的新配置文件。根据在STEP 1中创建的参数进行修改。您将需要角色arn来替换下面的角色。您还需要您授予的帐户的个人资料名称。在此示例中，配置文件名称为“default”。

此处示例：

[skynetci-cross-account]
role_arn = arn:aws:iam::191070ABCDEF:role/Test-CrossAccountRole-IZDDLRUMABCD
source_profile = default

第3步：测试交叉访问

aws --profile skynetci-cross-account s3 ls s3：// bucket-name

Answer 3

要实现目标，您需要在目标S3存储桶中设置存储桶策略：

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "DelegateS3Access",
            "Effect": "Allow",
            "Principal": {
                "AWS": "arn:aws:iam::MAIN_ACCOUNT_ID:USER_NAME"
            },
            "Action": "s3:*",
            "Resource": [
                "arn:aws:s3:::BUCKET_NAME/*",
                "arn:aws:s3:::BUCKET_NAME"
            ]
        }
    ]
}

并允许此用户拥有S3权限。

{
   "Version": "2012-10-17",
   "Statement": [
      {
         "Sid": "Example",
         "Effect": "Allow",
         "Action": [
            "s3:*"
         ],
         "Resource": [
             "*"            
         ]
      }
   ]
}

在这种情况下，您不需要在目标帐户上承担角色。用户本身将能够访问另一个帐户中的存储桶。

设置IAM用户/角色的跨账户访问权限

3 个答案: