CODEWITHSUNDEEP
amazon-web-servicesamazon-redshift
Carlos Eduardo Abrantes
Carlos Eduardo Abrantes

Reputation: 53

Is it possible to access Redshift with an IAM role from another account? how?

We’re trying to implement Redshift with authentication via SAML.

In our case, we have many AWS accounts and the Redshift cluster is in one of them. We need to viabilize the access via roles from these accounts to the one that hosts the cluster. Discarding the necessity of having to manage user/password.

The way we implemented it’s already possible to login using IAM roles, but we still need the cross-account.

Does anyone knows if it's possible ?

Upvotes: 0

Views: 2790

Answers (1)

John Rotenstein
John Rotenstein

Reputation: 269746

Since you already have signin working with IAM roles, the process would be:

  • Amazon Redshift in Account-A
  • IAM Role (Role-A) in Account-A that has:
    • Permission to access Redshift via IAM (I think it's just permission to call GetClusterCredentials?)
    • A Trust Policy allowing the Role to be assumed by specified other accounts (or specific roles in those accounts)
  • Other accounts wanting to access Redshift will:
    • Call AssumeRole() to assume Role-A
    • Use the returned temporary credentials to access Redshift using Role-A

Thus, Redshift only ever sees a login being requested from Account-A.

Upvotes: 2

Related Questions