CODEWITHSUNDEEP
amazon-web-servicesaws-lambda
Farzad
Farzad

Reputation: 53

Problem with AWS Lambda and cross account roles

I need to assume a cross account role to get access to an ElasticSearch domain for logging on AWS. Here's what I've done:

First, I have created a cross account role in ACCOUNT1. The role name is LoggerAccessToES and the trust relationship is something like this:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": {
        "Service": "lambda.amazonaws.com"
      },
      "Action": "sts:AssumeRole"
    },
    {
      "Effect": "Allow",
      "Principal": {
        "AWS": [
          "arn:aws:iam::ACCOUNT1:root",
          "arn:aws:iam::ACCOUNT2:root"
        ]
      },
      "Action": "sts:AssumeRole",
      "Condition": {}
    }
  ]
}

Then, on ACCOUNT2, I have created a Lambda function to assume the above role with this code:

        sts_client = boto3.client('sts', region_name=Config.AWS_ES_REGION)
        assumed_role_object=sts_client.assume_role(
            RoleArn="arn:aws:iam::ACCOUNT1:role/LoggerAccessToES",
            RoleSessionName="AssumeLoggerAccessToESSession1"
        )

When I invoke the lambda (basically the lambda is attached to an SNS topic), I get the error:

botocore.exceptions.ClientError: An error occurred (AccessDenied) when calling the AssumeRole operation: Access denied

I've already tried everything was suggested by other guys in other questions and I also googled the problem but I couldn't find the resolution. What am I doing wrong here?

Upvotes: 1

Views: 5698

Answers (1)

C0d3ine
C0d3ine

Reputation: 469

From what i understand, you want to assume a role in Account 1 using the lambda in account 2.

This would require two roles to be created -

  1. The first role needs to be created in the Account 2 which is to be attached to the Lambda. This role needs to have the following permission attached - 
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": "sts:AssumeRole",
      "Resource": "arn:aws:iam::ACCOUNT1:role/LoggerAccessToES"
    }
}

The above policy can be added to your existing lambda execution role.

  1. For the second part, only the trust relationship of the Role LoggerAccesstoEs needs to be addedin Account 1 shown below- 
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": {
        "AWS": "arn:aws:iam::ACCOUNT2:root"
      },
      "Action": "sts:AssumeRole",
      "Condition": {}
    }
  ]
}

The first role policy allows the lambda to use the AssumeRole. The second policy allows the Account 1 to trust the AssumeRole request from Account 2.

Upvotes: 3

Related Questions