Accessing S3 across accounts I can do it if logged in the origin account but not if assuming a role from another account

0

When I log directly in the origin account I have access to target account S3:

[cloudshell-user@ip-10-0-91-7 ~]$ aws sts get-caller-identity { "UserId": "AIDAxxxxxxxxJBLJ34", "Account": "178xxxxxx057", "Arn": "arn:aws:iam::178xxxxxx057:user/adminCustomer" }

[cloudshell-user@ip-10-0-91-7 ~]$ aws s3 ls s3://target-account-bucket 2022-03-10 01:28:05 432 foobar.txx

However if I do it after assuming a Role in that account I can't access the target account

[cloudshell-user@ip-10-1-12-136 ~]$ aws sts get-caller-identity { "UserId": "AROAxxxxxxF5HI7BI:test", "Account": "178xxxxxx057", "Arn": "arn:aws:sts::178xxxxxx4057:assumed-role/ReadAnalysis/test" }

[cloudshell-user@ip-10-1-12-136 ~]$ aws s3 ls s3://targer-account-bucket

An error occurred (AccessDenied) when calling the ListObjectsV2 operation: Access Denied [cloudshell-user@ip-10-1-12-136 ~]$

however I do have access to buckets in the origin account

[cloudshell-user@ip-10-1-12-136 ~]$ aws s3 ls s3://origin-account

2022-03-09 21:19:36 432 cli_script.txt

the policy in the target-account-bucket is as follows:

  {
        "Effect": "Allow",
        "Principal": {
            "AWS": "arn:aws:iam::178xxxxxx057:root"
        },
        "Action": [
            "s3:*"            ],
        "Resource": [
            "arn:aws:s3:::targer-account-bucket/*",
            "arn:aws:s3:::targer-account-bucket"
        ]
    },

there are no any explicit Deny policies that may apply

thank you for any advice you can provide

1개 답변
0
수락된 답변

Make sure that the policy assigned to the role allows access to the bucket. See: Cross-account policy evaluation logic.

"The principal's identity-based policy must allow the requested access to the resource in the trusting service."

profile pictureAWS
전문가
kentrad
답변함 2년 전

로그인하지 않았습니다. 로그인해야 답변을 게시할 수 있습니다.

좋은 답변은 질문에 명확하게 답하고 건설적인 피드백을 제공하며 질문자의 전문적인 성장을 장려합니다.

질문 답변하기에 대한 가이드라인

관련 콘텐츠