Gamelift Fleet Instance does not have permission to assumeRole on a gamelift-principal Role anymore.

Question

Hi!
I'm currently running a **secondary process on gamelift instances** to help with server log gathering. This process needs some AWS permissions, which it acquires by doing an **assumeRole on the fleet's InstanceRole.**
This instanceRole is setup with the following trust policy :
```
{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Principal": {
                "Service": [
                    "gamelift.amazonaws.com"
                ]
            },
            "Action": "sts:AssumeRole"
        }
    ]
}
```

I haven't been monitoring that logging process very closely, and recently discovered that it wasn't able to assume this role anymore.
I've been trying to specify the gamelift region, to no avail. The only way I was able to re-assume the role from the instance was to get the instance's role through get-caller-identity (after ssm-ing on the instance), and adding this auto-generated role to the trust policy by hand.

Here's the error that happens when attempting to assume-role from the gamelift fleet:

```
sh-4.2$ aws sts assume-role --role-arn=arn:aws:iam:::role/the-role-i-want-to-assume --role-session-name=testassumesession
An error occurred (AccessDenied) when calling the AssumeRole operation: User: arn:aws:sts:::assumed-role/DevAppStack-58eee978-59ae-42a0-9a8-AppInstanceRole-EDM3O84AF9S0/i-09dbb0c0bde30b348 is not authorized to perform: sts:AssumeRole on resource: arn:aws:iam:::role/the-role-i-want-to-assume
```
I'm kind of in the dark about what the default "assumed-role" we see here really is: I presume it's a default AWS account that represents gamelift, but I'm not too sure about it ?

Any ideas why the assumeRole doesn't work anymore, or ideas of things to try out ?
Thanks !

Answer

Hi!
It totally makes sense, but what if the caller is not a game server but a "sidecar" process running on the instance for example for log gathering purposes?

I assumed, looking at the Server SDK interactions that it was only meant for processes that are hosting game sessions.

Answer

Hello,

When running an SDK 5 fleet, you should call the ServerSDKAPI GetFleetRoleCredentials() and use those credentials to assume your role.

* Guide for migrating to SDK 5: https://docs.aws.amazon.com/gamelift/latest/developerguide/reference-serversdk.html
* API reference for GetFleetRoleCredentials: https://docs.aws.amazon.com/gamelift/latest/developerguide/integration-server-sdk5-csharp-actions.html#integration-server-sdk5-csharp-getfleetrolecredentials

Regards,

Answer

Hello there,

Your trust policy shows that the service "gamelift.amazonaws.com  " is the only allowed principal that can assume the target role.

According to the access denied error, the role DevAppStack-58eee978-59ae-42a0-9a8-AppInstanceRole does not have the sufficient permissions to assume the next role.

There are 2 requirements to assume a role successfully, the instance role needs the sts:AssumeRole permissions and the ARN of the instance role needs to be explicitly defined in trust policy of the role that is being assumed. [1]

To resolve your issue, I suggest confirming that the trust policy of the role that is being assumed to include the ARN of the instance role DevAppStack-58eee978-59ae-42a0-9a8-AppInstanceRole as an additional principal for role assumption. Furthermore, evaluate that your instance role has the sts:AssumeRole permissions attached.

Sample trust policy: arn:aws:iam::Account-ID:role/the-role-i-want-to-assume:

{
  "Version": "2008-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": {
        "AWS": "arn:aws:iam::Account-ID:role/DevAppStack-58eee978-59ae-42a0-9a8-AppInstanceRole-EDM3O84AF9S0"
      },
      "Action": "sts:AssumeRole"
    }
  ]
}

Sample IAM policy for Instance role: arn:aws:iam::Account-ID:role/DevAppStack-58eee978-59ae-42a0-9a8-AppInstanceRole-EDM3O84AF9S0:

{
      "Action": "sts:AssumeRole",
      "Resource": "arn:aws:iam::Account-ID:role/the-role-i-want-to-assume",
      "Effect": "Allow"
}

N.B. Please ensure that the ARN's in the sample trust policy is replaced with the correct ARN for your instance role i.e. with the correct account number, etc.

If further assistance is required to troubleshoot a specific error received, may I recommend opening an Internal Ticket with AWS Support for further assistance

References:
[1] https://repost.aws/knowledge-center/iam-assume-role-cli

Gamelift Fleet Instance does not have permission to assumeRole on a gamelift-principal Role anymore.

Relevant content