amazon-web-services - 设置 IAM 用户/角色的跨账户访问

Question

我有一个主账户用户，我希望允许其访问子账户 S3 存储桶。我在我的子帐户中设置了以下堆栈

AWSTemplateFormatVersion : '2010-09-09'
Description: 'Skynet stack to allow admin account deploying user to access S3'

Parameters:
  AccountId:
    Type: String
    Description: Account ID of admin account (containing user to allow)
  Username:
    Type: String
    Description: Username to be allowed access
  BucketPrefix:
    Type: String
    Description: Bucket to be allowed (prefix appended with -{AccountId}-{Region})

Resources:
  CrossAccountRole:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Statement:
          - Effect: Allow
            Action: sts:AssumeRole
            Principal:
              AWS:
                - !Sub arn:aws:iam::${AccountId}:user/${Username}
      Path: /
      Policies:
        - PolicyName: skynet-s3-delegate
          PolicyDocument:
            Statement:
              - Effect: Allow
                Action:
                  - s3:ListBucket
                  - s3:GetObject
                Resource: "*"

但是我发现当我尝试承担这个角色时仍然出现错误:

aws s3 cp skynet-lambda.zip s3://skynet-lambda-TARGET_ACCOUNT_ID-ap-southeast-1 --profile skynetci-cross-account

An error occurred (AccessDenied) when calling the AssumeRole operation: User: arn:aws:iam::MAIN_ACCOUNT_ID:user/circleci-skynet is not authorized to perform: sts:AssumeRole on resource: arn:aws:iam::TARGET_ACCOUNT_ID:role/StackSet-df0e85b0-d6fd-47bf-a0bb-CrossAccountRole-1EW45TXEFAY0D

考虑到我已经为用户制定了以下政策，为什么会这样

    {
        "Effect": "Allow",
        "Action": [
            "sts:AssumeRole"
        ],
        "Resource": "arn:aws:iam::TARGET_ACCOUNT_ID:role/StackSet-df0e85b0-d6fd-47bf-a0bb-CrossAccountRole-1EW45TXEFAY0D"
    }

Answer 1

您需要更新存储桶策略以允许跨帐户访问，示例策略如下:

{
   "Version": "2012-10-17",
   "Statement": [
      {
         "Sid": "Example permissions",
         "Effect": "Allow",
         "Principal": {
            "AWS": "arn:aws:iam::AccountB-ID:root"
         },
         "Action": [
            "s3:*"
         ],
         "Resource": [
            "arn:aws:s3:::examplebucket"
         ]
      }
   ]
}

还要确保尝试访问的 IAM 用户已附加此内联策略:

{
   "Version": "2012-10-17",
   "Statement": [
      {
         "Sid": "Example",
         "Effect": "Allow",
         "Action": [
            "s3:*"
         ],
         "Resource": [
            "arn:aws:s3:::examplebucket"
         ]
      }
   ]
}

您可以引用AWS Documentation