CODEWITHSUNDEEP
amazon-web-servicesamazon-s3amazon-kinesis-firehose
Joy
Joy

Reputation: 4511

Setting up write access of s3 owned by one aws account to firehose stream owned by another aws account

I have set up one Kinesis Firehose stream under account A. As per our requirement this stream should write data to s3 bucket owned by different aws account B, that involves:

  1. That s3 bucket should be coming in dropdown in associated firehose settings,
  2. That firehose stream should have write permission to that given s3 bucket.

Till now, I have added following policy to s3 bucket under account B (id 2) that I want to write from firehose under account A (id 1).

{
    "Version": "2008-10-17",
    "Statement": [
        {
            "Sid": "avs-bi-access",
            "Effect": "Allow",
            "Principal": {
                "AWS": [
                    "arn:aws:iam::1:root"
                ]
            },
            "Action": [
                "s3:ListBucket",
                "s3:GetObject",
                “s3:PutObject”
            ],
            "Resource": [
                "arn:aws:s3:::testBucket",
                "arn:aws:s3:::testBucket/*"
            ]
        }
    ]
}

Apart from it, in the role used by Firehose under account A (id 1), trust relationship is as follows:

{
"Version": "2012-10-17",
"Statement": [
 {
  "Sid": "",
  "Effect": "Allow",
  "Principal": {
    "Service": "firehose.amazonaws.com",
    "AWS": "arn:aws:iam::2:root"
  },
  "Action": "sts:AssumeRole"
  }
]
}

Even after that, I cannot select the given bucket in Firehose configuration page. I think, I am missing something.

Upvotes: 2

Views: 5519

Answers (1)

John Rotenstein
John Rotenstein

Reputation: 270184

You should follow the directions on:

Basically:

  • Your S3 policy should have a Principal pointing to the IAM Role used by Firehose
  • The samples didn't include an AWS value in the Role principal

You will never get a bucket from another account showing in the pull-down list in the console. Instead, you will need to choose the bucket when creating the Firehose Delivery Stream via an API/CLI call, or you can use the update-destination API call to change the destination:

aws firehose update-destination --delivery-stream-name foo --current-delivery-stream-version-id 1 --destination-id 'destinationId-000000000001' --extended-s3-destination-update '{"BucketARN":"arn:aws:s3:::YOUR-BUCKET"}'

You can obtain the version and destination-id via:

aws firehose describe-delivery-stream --delivery-stream-name foo

Disclaimer: I tried all of the above and managed to get the bucket selected. However, I didn't get any data delivered to the bucket. Perhaps you'll have more success than I did.

Upvotes: 3

Related Questions