CODEWITHSUNDEEP
c#amazon-web-servicesamazon-dynamodb
Chetan
Chetan

Reputation: 6911

Cross Account Access to DynamoDb tables C#

I have been dealing with this issue for which I am not able to find solution online anywhere.

I have a code which connects to AWS DynmoDb and performs read/write operations on one or more tables. This worked fine as long as my code and the DynamoDb table are in the same AWS account. Also the code uses the IAM Role attached to the Web Server. The role as all the necessary permissions assigned to it.

private AmazonDynamoDBClient GetDbClient(int ConnectionTimeOut, int ReadWriteTimeOut, int MaxRetry)
    {

        AmazonDynamoDBConfig clientConfig = new AmazonDynamoDBConfig 
        {
            Timeout = TimeSpan.FromMilliseconds(ConnectionTimeOut), 
            ReadWriteTimeout = TimeSpan.FromMilliseconds(ReadWriteTimeOut), 
            MaxErrorRetry = MaxRetry
        };

        return new AmazonDynamoDBClient(clientConfig);
    }

Recently I need to move my code to different AWS account and things started going crazy.

Following steps I have already taken.

With this change, I do not see any more permission errors but the code tries to look for the table on the new AWS account.

It is clear in the code that AWS AccountId is not used anywhere while creating AWS DynamoDb client. So I assume that I should be able to tell the code where to look for DynamoDb table. But the C# SDK of DynamoDb does not have any provision where I can provide AWS AccountId while creating DynamoDb client.

So my issue here is related to C# code to connect to DynamoDb service and not the IAM roles and permissions on AWS (for this I am able to fine plenty of solution).

Found this question aws cross account dynamodb access with IAM role with similar issue but it does not suggest the fix to do in the code.

Upvotes: 3

Views: 1450

Answers (2)

kgiannakakis
kgiannakakis

Reputation: 104198

One way to proceed is to use Security Token Service. First you need to assume a role and get temporary credentials:

Credentials GetCredentials(String roleArn)
{
    using (var stsClient = new AmazonSecurityTokenServiceClient())
    {
        try
        {
            var response = stsClient.AssumeRole(new AssumeRoleRequest(roleARN));
    
            if (response.HttpStatusCode == System.Net.HttpStatusCode.OK) return response.Credentials;
        }
        catch (AmazonSecurityTokenServiceException ex)
        {
            return null;
        }
    }
}

You can then use the credentials to initiate your DynamoDB client.

See another example here.

Upvotes: 2

Norman
Norman

Reputation: 494

The AWS SDK and CLI (whether it's running locally or on (say) an EC2 instance) looks in the following locations for credentials:

  1. Command line options
  2. Environment variables
  3. CLI credentials file
  4. CLI configuration file
  5. Container credentials
  6. Instance profile credentials

If you have a credentials file configured, then, assuming we're running under the default profile, this will indirectly define the account under which it is running via the access key provided.

You can also define AWS-specific environment variables, such as AWS_ACCESS_KEY_ID which take precedence over the credentials file.

https://docs.aws.amazon.com/cli/latest/userguide/cli-configure-quickstart.html

Upvotes: 1

Related Questions