Is it bad practice to allow my IAM user account to allow AssumeRole to every account (wildcard "*") ?

Question

I have my AWS Account and I want other people to grant me access to their AWS resources (for example S3). For the following thing to work I want to assume the role that they have created in their accounts. I follow this tutorial - https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_common-scenarios_third-party.html?icmpid=docs_iam_console

The problem is that I can't know which users will grant me access to their roles (and their ARNs), so are there any risks and is it bad (and if yes - why) from security and technical point of view to allow my user to assume roles from everywhere by adding this policy:

```
{
	"Version": "2012-10-17",
	"Statement": [
		{
			"Sid": "Statement1",
			"Effect": "Allow",
			"Action": "sts:AssumeRole",
			"Resource": "*"
		}
	]
}
```

secondabhi_aws · Accepted Answer

It's always best to go with least privileged model and specify only those roles which are required to be assumed. But if your question is more towards cross account assume role, then this is fine, reason being, as long as other account role doesn't add this user in it's trust relationship, this user would not be able to assume other account role anyway.

I've seen developers following this practice to avoid the operational overhead as otherwise, you'll have to add the role every time to this IAM policy when you would need to assume a newly created role in another account. But certainly "*" is not recommended.

Please refer following documentation, which talk about this specific topic in very detail.

- [AWS Documentation](https://docs.aws.amazon.com/IAM/latest/UserGuide/tutorial_cross-account-with-roles.html)
- [Cross account IAM Access](https://repost.aws/knowledge-center/cross-account-access-iam)

Hope this information helps.

Comment here if you have additional questions, happy to help.

Abhishek

Is it bad practice to allow my IAM user account to allow AssumeRole to every account (wildcard "*") ?

Adicione sua resposta

Conteúdo relevante