ACCESSING SECRET CREDENTIALS

Question

I want to create a role in AWS organization account which have permissions to access few security credentials.
This role need to be assumed by members accounts to carry out some tasks. They should only have permission to do a particular task. In a way they shouldn't be able to change the task, They can't use the credentials for any other task or they shouldn't have access to print/view the security credentials.

jay-aws · Answer

Hi There, You can implement the principle of least privilege for cross-account [access](https://docs.aws.amazon.com/IAM/latest/UserGuide/tutorial_cross-account-with-roles.html).

In your AWS Organization's management account, you can create a IAM role:

```
    
{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Principal": {
                "AWS": [
                    "arn:aws:iam::MEMBER-ACCOUNT-ID-1:root",
                    "arn:aws:iam::MEMBER-ACCOUNT-ID-2:root"
                ]
            },
            "Action": "sts:AssumeRole",
            "Condition": {
                "StringEquals": {
                    "aws:PrincipalOrgID": "YOUR-ORGANIZATION-ID"
                }
            }
        }
    ]
}
```

Then you can create a custom [policy](https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_managed-vs-inline.html#customer-managed-policies) for the specific task (example for accessing a specific Secret):

```

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "secretsmanager:GetSecretValue"
            ],
            "Resource": "arn:aws:secretsmanager:REGION:ACCOUNT-ID:secret:SPECIFIC-SECRET-NAME"
        }
    ]
}

```

And in the member accounts, create an IAM policy to allow specific users/roles to assume the organization account role:

```
{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": "sts:AssumeRole",
            "Resource": "arn:aws:iam::ORGANIZATION-ACCOUNT-ID:role/ROLE-NAME"
        }
    ]
}
```

Then your users can then assume the [role](https://docs.aws.amazon.com/cli/latest/reference/sts/assume-role.html) using AWS CLI:

```
aws sts assume-role --role-arn arn:aws:iam::ORGANIZATION-ACCOUNT-ID:role/ROLE-NAME --role-session-name MySession
```

This way only member accounts within your organization can assume the role
and you can sope the role, so it only has permissions for the specific task needed. The users can't view/modify the actual credentials
All the role assumptions are logged in [CloudTrail](https://docs.aws.amazon.com/awscloudtrail/latest/userguide/cloudtrail-user-guide.html)

Additional Best Practices:
    Use session duration [limits](https://docs.aws.amazon.com/singlesignon/latest/userguide/howtosessionduration.html) in the role trust policy

Regularly review CloudTrail logs for role usage

Use AWS Organizations [SCPs](https://docs.aws.amazon.com/organizations/latest/userguide/orgs_manage_policies_scps.html) for additional restrictions

HTH

ACCESSING SECRET CREDENTIALS

Relevant content