Accessing S3 across accounts I can do it if logged in the origin account but not if assuming a role from another account

0

When I log directly in the origin account I have access to target account S3:

[cloudshell-user@ip-10-0-91-7 ~]$ aws sts get-caller-identity { "UserId": "AIDAxxxxxxxxJBLJ34", "Account": "178xxxxxx057", "Arn": "arn:aws:iam::178xxxxxx057:user/adminCustomer" }

[cloudshell-user@ip-10-0-91-7 ~]$ aws s3 ls s3://target-account-bucket 2022-03-10 01:28:05 432 foobar.txx

However if I do it after assuming a Role in that account I can't access the target account

[cloudshell-user@ip-10-1-12-136 ~]$ aws sts get-caller-identity { "UserId": "AROAxxxxxxF5HI7BI:test", "Account": "178xxxxxx057", "Arn": "arn:aws:sts::178xxxxxx4057:assumed-role/ReadAnalysis/test" }

[cloudshell-user@ip-10-1-12-136 ~]$ aws s3 ls s3://targer-account-bucket

An error occurred (AccessDenied) when calling the ListObjectsV2 operation: Access Denied [cloudshell-user@ip-10-1-12-136 ~]$

however I do have access to buckets in the origin account

[cloudshell-user@ip-10-1-12-136 ~]$ aws s3 ls s3://origin-account

2022-03-09 21:19:36 432 cli_script.txt

the policy in the target-account-bucket is as follows:

  {
        "Effect": "Allow",
        "Principal": {
            "AWS": "arn:aws:iam::178xxxxxx057:root"
        },
        "Action": [
            "s3:*"            ],
        "Resource": [
            "arn:aws:s3:::targer-account-bucket/*",
            "arn:aws:s3:::targer-account-bucket"
        ]
    },

there are no any explicit Deny policies that may apply

thank you for any advice you can provide

1 Antwort
0
Akzeptierte Antwort

Make sure that the policy assigned to the role allows access to the bucket. See: Cross-account policy evaluation logic.

"The principal's identity-based policy must allow the requested access to the resource in the trusting service."

profile pictureAWS
EXPERTE
kentrad
beantwortet vor 2 Jahren

Du bist nicht angemeldet. Anmelden um eine Antwort zu veröffentlichen.

Eine gute Antwort beantwortet die Frage klar, gibt konstruktives Feedback und fördert die berufliche Weiterentwicklung des Fragenstellers.

Richtlinien für die Beantwortung von Fragen