CODEWITHSUNDEEP
amazon-web-servicesamazon-iam
Somethingwhatever
Somethingwhatever

Reputation: 1348

How to assign a role to an iam user?

I am trying to assign a role to a user using the AWS console but not having a whole lot of success with it. So I created a user David and I created a role with a trust policy in which I am assigning the David i.e. IAM user as the principal which looks like this:

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "Statement1",
            "Effect": "Allow",
            "Principal": {
                "AWS": "arn:aws:iam::Account-ID:user/David"
            },
            "Action": "sts:AssumeRole"
        }
    ]
}

and I also attached a policy to the role which lets the user listbuckets and getobject. The policy looks like this:

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "Allowsusertotolistbuckets",
            "Effect": "Allow",
            "Action": [
                "s3:ListBucket",
                "s3:GetObject"
            ],
            "Resource": "arn:aws:s3:::*"
        }
    ]
}

Now when I run aws configure and authenticate as David user with the right access key and secret access key and run aws s3 ls. I run into the following: An error occurred (AccessDenied) when calling the ListBuckets operation: Access Denied. How can I have the user assume the role?

Upvotes: 1

Views: 1758

Answers (1)

John Rotenstein
John Rotenstein

Reputation: 269340

IAM Roles are not 'attached' to a user. Rather, an IAM User can be permitted to assume an IAM Role.

Using the AWS CLI, they would assume an IAM Role like this:

aws sts assume-role --role-arn arn:aws:iam::123456789012:role/xaccounts3access --role-session-name s3-access-example

In response, AWS STS will return a set of temporary credentials:

{
    "AssumedRoleUser": {
        "AssumedRoleId": "AROA3XFRBF535PLBIFPI4:s3-access-example",
        "Arn": "arn:aws:sts::123456789012:assumed-role/xaccounts3access/s3-access-example"
    },
    "Credentials": {
        "SecretAccessKey": "9drTJvcXLB89EXAMPLELB8923FB892xMFI",
        "SessionToken": "AQoXdzELDDY//////////wEaoAK1wvxJY12r2IrDFT2IvAzTCn3zHoZ7YNtpiQLF0MqZye/qwjzP2iEXAMPLEbw/m3hsj8VBTkPORGvr9jM5sgP+w9IZWZnU+LWhmg+a5fDi2oTGUYcdg9uexQ4mtCHIHfi4citgqZTgco40Yqr4lIlo4V2b2Dyauk0eYFNebHtYlFVgAUj+7Indz3LU0aTWk1WKIjHmmMCIoTkyYp/k7kUG7moeEYKSitwQIi6Gjn+nyzM+PtoA3685ixzv0R7i5rjQi0YE0lf1oeie3bDiNHncmzosRM6SFiPzSvp6h/32xQuZsjcypmwsPSDtTPYcs0+YN/8BRi2/IcrxSpnWEXAMPLEXSDFTAQAM6Dl9zR0tXoybnlrZIwMLlMi1Kcgo5OytwU=",
        "Expiration": "2016-03-15T00:05:07Z",
        "AccessKeyId": "ASIAJEXAMPLEXEG2JICEA"
    }
}

These credentials can then be used to call AWS service 'as the IAM Role' rather than 'as the IAM User'.

See: assume-role — AWS CLI Command Reference

To make things easier, it is possible to define a profile that uses an IAM Role. The AWS CLI will automatically use IAM User credentials to call AssumeRole(), then use the resulting credentials to make the desired API call.

Here is an example profile entry:

[profile marketingadmin]
role_arn = arn:aws:iam::123456789012:role/marketingadminrole
source_profile = user1

This is saying: "Use the IAM User credentials from profile user1 to call AssumeRole() on the marketingadminrole"

It can then be used like this:

aws s3 ls s3://marketing-bucket --profile marketingadmin

See: Using an IAM role in the AWS CLI - AWS Command Line Interface

Upvotes: 1

Related Questions