CODEWITHSUNDEEP
amazon-web-servicesamazon-iam
charli
charli

Reputation: 1778

Is it possible to specify a pattern for an AWS role Trust Relationship

I want to allow some roles from a different account to assume a role in my account. I don't want to specify the roles one by one, because they're prone to change frequently.

I came up with this policy for the Trust Relationship, which should allow any role which name ends with _my_suffix, but it doesn't work (access is denied):

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": {
        "AWS": "arn:aws:iam::ACCOUNT_NR_A:root"
      },
      "Condition": {
        "ArnLike": {
          "aws:SourceArn": "arn:aws:iam::ACCOUNT_NR_A:role/*_my_suffix"
        }
      },
      "Action": "sts:AssumeRole"
    }
  ]
}

On the other hand, this policy works but it's too open, as it allows any user/role in account A to assume my role:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": {
        "AWS": "arn:aws:iam::ACCOUNT_NR_A:root"
      },
      "Action": "sts:AssumeRole"
    }
  ]
}

So, is there any way to allow only a set of roles without being explicitly specified?

Upvotes: 29

Views: 28729

Answers (3)

Mark Mc
Mark Mc

Reputation: 556

I encountered the same use-case recently. None of the responses resolved this for me.

Charli, your original solution is valid but I needed some tweaks get it to work, namely, I needed to replace 'ArnLike' with 'stringLike' and switch 'aws:SourceArn' to use 'aws:PrincipalArn':

    {
      "Effect": "Allow",
      "Principal": {
        "AWS": "arn:aws:iam::<ACCOUNT_ID>:root"
      },
      "Action": "sts:AssumeRole",
      "Condition": {
        "StringLike": {
          "aws:PrincipalArn": "arn:aws:iam::<ACCOUNT_ID>:role/test-role-name-*"
        }
      }
    }

Upvotes: 51

sudo
sudo

Reputation: 2327

It is not possible to use wildcard in the trust policy except "Principal" : { "AWS" : "*" } . The reason being when you specify an identity as Principal, you must use the full ARN since IAM translates to the unique ID e.g. AIDAxxx (for IAM user) or AROAxxx (for IAM role). Below is the from document:

If your Principal element in a role trust policy contains an ARN that points to a specific IAM user, then that ARN is transformed to the user's unique principal ID when the policy is saved. This helps mitigate the risk of someone escalating their privileges by removing and recreating the user. You don't normally see this ID in the console, because there is also a reverse transformation back to the user's ARN when the trust policy is displayed.

Upvotes: 4

Amey Puranik
Amey Puranik

Reputation: 13

This seems to an issue with delegating access to trusting account(your account) and not the trusted account(_my_suffix - AWS account). These are few things that you can check in the following URL.

Link: https://docs.aws.amazon.com/IAM/latest/UserGuide/tutorial_cross-account-with-roles.html

Thanks

Upvotes: 0

Related Questions