1 Answer
- Newest
- Most votes
- Most comments
0
Hello.
To do this, I think you need to create an IAM role in account B that account A can use to establish a trust relationship.
I think the following document settings will be helpful.
https://repost.aws/knowledge-center/cross-account-access-iam
https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies-cross-account-resource-access.html
In account B, create an IAM role with the following trust policy:
Also, attach an IAM policy to the IAM role you created to operate the bucket policy.
{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Principal": {
"AWS": "arn:aws:iam::AccountAID:user/user-name"
},
"Action": "sts:AssumeRole"
}
]
}
For the IAM user in Account A, set an IAM policy that allows them to AssumeRole the IAM role created in Account B as shown below.
{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Action": [
"sts:AssumeRole"
],
"Resource": [
"arn:aws:iam::AccountBID:role/role-name"
]
}
]
}
Relevant content
- asked a year ago
