- Newest
- Most votes
- Most comments
There is a way to share Cloud9 env with AWS Users (SSO), but you need a User ARN
Follow these steps to grand access:
- To get an Identity for AWS User you want to share Cloud9 Env, please ask her or him to execute the below command in AWS CloudShell/Terminal or Cloud9:
aws sts get-caller-identity
- Ask them to Copy an ARN from the JSON response and send it to you.
- Open a Cloud9 Env that you want to share with the user.
- in Cloud9 top right corner, click share
- in the "Invite members" section, paste the copied ARN from the previous step.
- choose access type Read & Write (RW) or only read (R)
- click the Invite button
- send a URL link to your Cloud9 for the user you are granted access.
- Happy coding {>;}
Have you taken a look at this - https://docs.aws.amazon.com/cloud9/latest/user-guide/setup-enterprise.html
The referenced document seems to explain how a federated (SSO) user can access Cloud9. But I believe the question is how that user, having started a Cloud9 instance, can share the Cloud9 environment by inviting another SSO user in the account. In order to do that, the “owner” of the Cloud9 environment must click “share” in the Cloud9 environment and then enter an “IAM username” to “invite” another user. As the OP stated, that only seems to work for regular IAM users, not IAM Identity Center users. (As an aside, it is extremely strange that Cloud9 environments are user-specific, given that it is designed for real-time collaboration. Would not IAM be sufficient for access control, as with almost every other AWS service?)
Relevant content
- asked 2 years ago
- asked 8 months ago
AWS OFFICIALUpdated 3 years ago- AWS OFFICIALUpdated 5 months ago
- AWS OFFICIALUpdated 3 years ago
Indeed using the full arn works! I honestly thought I had tried that. Note that if multiple users have the same sso configuration, likely only the very last part of the arn will differ. Thank you very much @skroczak. (I still think better IAM integration would be much preferred for many reasons.)
How can we share to all the users which are using the same permission set in the federated users? DOes it allows the wild cards? Ex: if the federated user permission set is arn:aws:sts::<account-id>:assumed-role/AWSReservedSSO_ps-07224-c-002_c240e72bbc80fb73/*/ps-07224-c-002?