Iam assume role for cross account

0

I am using EKS to run terraform and created service account for aws access, Also I want to get access for of cross account using assume role, created the role in cross account and created new role in primary account with inline policy, and added in terraform as below

provider "aws" {
  region = "us-east-1"
  assume_role {   role_arn = "arn:aws:iam:11111111111:role/atlantis-prod-account"   }
 } 

while doing terraform plan getting error

Planning failed. Terraform encountered an error while generating this plan.

╷
│ Error: configuring Terraform AWS Provider: IAM Role (arn:aws:iam::222222222222:role/atlantis-prod-account) cannot be assumed.
│ 
│ There are a number of possible causes of this - the most common are:
│   * The credentials used in order to assume the role are invalid
│   * The credentials do not have appropriate permission to assume the role
│   * The role ARN is not valid
│
│ AWS Error: operation error STS: AssumeRole, https response error StatusCode: 403, RequestID: 0992e01d-f14c-4ce0-a035-7bb4b281c93b, api error AccessDenied: User: arn:aws:sts::2222222222222:assumed-role/atlantis-tf/16875811711115
96442 is not authorized to perform: sts:AssumeRole on resource: arn:aws:iam::2222222222222:role/atlantis-prod-account
│
│
│   with provider["registry.terraform.io/hashicorp/aws"],
│   on main.tf line 1, in provider "aws":
│    1: provider "aws" {
3개 답변
1

Your role ARN is incorrect, missing a ':' where the region would be in other ARNs.

IAM identifiers

arn:aws:iam::account:role/role-name-with-path
profile pictureAWS
전문가
kentrad
답변함 10달 전
profile pictureAWS
전문가
iBehr
검토됨 10달 전
  • arn:aws:iam::11111111111:role/atlantis-prod-account

0

How about setting sts_region in the same way as this issue?
https://github.com/hashicorp/terraform-provider-aws/issues/26685

profile picture
전문가
답변함 10달 전
  • not working

0

How are you authenticating to sts before assuming the role?

Can you confirm Where are you running from.

You need to authenticate to sts first with a role or user account before assuming the role defined in TF.

profile picture
전문가
답변함 10달 전

로그인하지 않았습니다. 로그인해야 답변을 게시할 수 있습니다.

좋은 답변은 질문에 명확하게 답하고 건설적인 피드백을 제공하며 질문자의 전문적인 성장을 장려합니다.

질문 답변하기에 대한 가이드라인

관련 콘텐츠