Skip to content
By using AWS re:Post, you agree to the AWS re:Post Terms of Use
AWS re:Postre:Post
About re:Post

Cross Account Access Permissions

0

We have an org with a sub account created through the console. I have AzureAD SAML SSO configured and that has been working properly (AFAIK) to the main account. I want to have other users switch role into the sub account for sandbox testing etc. I have created the role in the sub account and assigned permissions, created a policy for sts assumerole for that sub account role, assigned the policy to a group, and the user is in that group. The user can login via SSO to the main account, but cannot switch role while my account (when added to the group) can switch to my new role. If I give the other user AdministrativeRights they can switch role now, so it seems there is some permission missing that they cannot switch role, but I cannot seem to figure out what that is. Are there any other permissions required to switch role other than the STS policy? Everything I've read says no, but my experience is to the contrary.

  • rePost-User-6648732
    2 years ago

    A proper trust relationship and permissions policy should facilitate this. sts:AssumeRole(WithSAML/WebIdentity) is the required action in the permission policy. Have you checked CloudTrail logs for more information on what is being blocked?

Topics
Management & GovernanceSecurity, Identity, & Compliance
Tags
AWS Identity and Access ManagementIAM PoliciesAWS Management Console
Language
English

asked 2 years ago335 views

2 Answers
0
Accepted Answer

I ended up switching from AWS SSO on the primary accounts IAM (and using switch role) to configuring Identity Center and applying permission sets directly to the accounts, the user just uses the AWS access portal to switch to accounts they have permissions to. This works much better (and is less confusing) than switch role (policy/role) config.

answered 2 years ago

0

Hello.

Are there any differences between the IAM you are using and the IAM used by other members?
For example, are there different groups or policies to which they belong?
You may also find something by checking the CloudTrail event history for "us-east-1" and checking the details of the error.
https://docs.aws.amazon.com/awscloudtrail/latest/userguide/tutorial-event-history.html

EXPERT

answered 2 years ago

  • Russ
    2 years ago

    All users are in the same IAM, the root account IAM, and it is SAML connected to AzureAD. I have two separate STS AssumeRole Policies for Admin and SystemAdmin roles on the sub account. My user and another persons user are in both groups that have the policies assigned to. The difference is, my SSO Role gives my account admin rights in the root account and the SSO role for the other user gives them no rights in the root account. I can switch to either role and the other user cannot switch to any role (in the sub account). I can add administrative permissions to the other users SSO role and then they can switch to either role.

    I setup a event in cloudtrail (wasnt using it before) and I'll see what that shows.

You are not logged in. Log in to post an answer.

A good answer clearly answers the question and provides constructive feedback and encourages professional growth in the question asker.

Relevant content