AWS IAM Identity Center and S3 cross-account access

Question

I have multiple accounts managed via IAM Identity Center.
In AccountA, I have an S3 bucket with "Block all public access" = ON.
I'm trying to grant people that have AdministratorAccess in AccountB to have RO access from that S3 bucket.

So, what I tried is to:

1. In AccountA, where the S3 bucket exists, I've set the Bucket policy to the following:

```yaml
{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Principal": {
                "AWS": "arn:aws:iam::xxxxxx:role/aws-reserved/sso.amazonaws.com/us-west-2/AWSReservedSSO_AdministratorAccess_e42b39700d9195e4"
            },
            "Action": [
                "s3:GetObject",
                "s3:ListBucket",
                "s3:GetBucketLocation"
            ],
            "Resource": [
                "arn:aws:s3:::/*",
                "arn:aws:s3:::"
            ]
        }
    ]
}
```

2. In Identity Center Permission Set, I added an Inline Policy:
```yaml
{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "s3:ListBucket",
                "s3:GetObject",
                "s3:GetBucketLocation"
            ],
            "Resource": [
                "arn:aws:s3:::/*",
                "arn:aws:s3:::"
            ]
        }
    ]
}
```

This doesn't work though. Am I missing some additional requirement when using IAM Identity Center?

Radek Antoniuk · Accepted Answer

WOW. I figured it out.

It turns out I had an SCP policy on the AWS Org, that limited all AWS services to us-west-2 region, where all my services are, but the bucket is in us-west-1. As soon as I added us-west-1 to permitted list of regions, it started working...

I have no idea which service it is requesting, I tried allowing for us-west-1 explicitly sts:* and kms:* and s3:*, but it still didn't work.

Gary Mclean · Answer

You dont need to have your bucket policy to grant access to the Identity Centre roles. Just ensure your permission set has S3 access to the bucket.
When the user assumes the role they will inturn be granted access to the S3 bucket.

Reason being, if you change the permission set it will generate a new one with a different role name.

Pandu · Answer

Hi Radek,

Please go through the below steps i hope it will helps to resolve your issue.

**1. S3 Bucket Policy in AccountA**

Ensure your S3 bucket policy allows access from the specific IAM roles used in AccountB. Here is the updated policy:

```
{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Principal": {
                "AWS": "arn:aws:iam::AccountB:role/aws-reserved/sso.amazonaws.com/us-west-2/AWSReservedSSO_AdministratorAccess_xxxxxxx"
            },
            "Action": [
                "s3:GetObject",
                "s3:GetBucketLocation"
            ],
            "Resource": [
                "arn:aws:s3:::my-bucket",
                "arn:aws:s3:::my-bucket/*"
            ]
        }
    ]
}

```
**2. IAM Role Assumption Policy in AccountB**

Ensure that the roles in AccountB have policies allowing them to assume the necessary roles in AccountA. Create or update the IAM policy as follows:

```
{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": "sts:AssumeRole",
            "Resource": "arn:aws:iam::AccountA:role/RoleNameInAccountA"
        }
    ]
}

```
**3. Identity Center Permission Set in AccountB**

Update the inline policy for the Permission Set to include the necessary permissions for the S3 bucket in AccountA:

```
{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": "s3:ListBucket",
            "Resource": "arn:aws:s3:::my-bucket"
        },
        {
            "Effect": "Allow",
            "Action": [
                "s3:GetObject",
                "s3:GetBucketLocation"
            ],
            "Resource": "arn:aws:s3:::my-bucket/*"
        }
    ]
}

```

Please loot at AWS Document Link you will get more information.

https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies-cross-account-resource-access.html

AWS IAM Identity Center and S3 cross-account access

Add your answer

Relevant content