CODEWITHSUNDEEP
amazon-web-servicessdkamazon-iamassume-role
questions
questions

Reputation: 3

AWS assume role access denied while using SDK

I am using go sdk to create a new role and assume it. Both are done with same IAM user. The role trust relationship is as follows:

{
    "Statement": [{
        "Effect": "Allow",
        "Principal": { "AWS": "<an admin user>" },
        "Action": [ "sts:AssumeRole" ]
    }]
}

Later when trying to add object to a bucket, I can create a session token, but the PutObject operations fails with AccessDenied. The bucket policy is:

{
      "Effect": "Allow",
      "Action":"s3:*",
      "Resource": [
        "arn:aws:s3:::<name of the bucket>/*"
      ],
      "Condition": {}
}

Upvotes: 0

Views: 1411

Answers (1)

b.short
b.short

Reputation: 131

If the role you are assuming does not grant access to the S3 bucket via the role policies, you'll need to add the role as a principal to the bucket policy.

There's a handy tool here; https://awspolicygen.s3.amazonaws.com/policygen.html that helps with generating bucket policies. But it should end up looking like:

{
      "Effect": "Allow",
      "Action":"s3:*",
      "Principal": {
          "AWS": ["arn:aws:iam::<accountid>:role/<name of assumed role>"]
      },
      "Resource": [
        "arn:aws:s3:::<name of the bucket>/*"
      ],
      "Condition": {}
}

Upvotes: 1

Related Questions