CODEWITHSUNDEEP
amazon-web-servicesamazon-cognitoamazon-iam
photosynthesis
photosynthesis

Reputation: 2890

Best practice to retrieve IAM role temporary credentials

We have an external application resides outside of Amazon network and it needs to access our SQS and send message there, in order for our AWS resource to recognize the request from that application it needs to sign its request with the credentials of the IAM role we created, I'm wondering what is the best way for that external application to retrieve temp credentials from us? I have tried to implement it using Amazon Cognito but it looks like Cognito fits more in scenarios like user sign-up and sign-in with an User Interface, anyone has any suggestions? Thanks in advance.

Upvotes: 0

Views: 413

Answers (1)

John Rotenstein
John Rotenstein

Reputation: 269550

To be able to obtain temporary credentials, you need a form of permanent credentials that can access (or generate) the temporary credentials.

Given your situation, you might consider creating an IAM User in your account and giving those credentials to the third-party. Grant the appropriate permissions to those credentials and they can use them directly with Amazon SQS.

Or, if you'd rather not give IAM credentials to third-parties, you could ask them to create an AWS account and an IAM User. You could then grant their IAM user access to the Amazon SQS queue.

Another option is that the third-party could access an application or API that you provide. Once they authenticate, you can provide temporary credentials created with the Security Token Service. Cognito would be an option for performing this authentication and it can also provide credentials for an associated IAM Role, thus giving them access to the Amazon SQS queue.

Upvotes: 2

Related Questions