How do you automate IAM Role Creation in Customers AWS account?

Question

I have a use case to automate the creation of IAM role and attaching a Permission policy to it for a Customers( internal ) AWS account( to which we may not have access to ). Any idea on how such automation can be done?

James_S · Answer

If you have no initial access to the AWS Account, the usual approach is for you to generate an AWS CloudFormation template which will create the Role with suitable Policies attached, and pass that to the customer for them to deploy. I'd suggest using tools such as cfn-nag and CloudFormation Guard to ensure your templates are following best practices and your own requirements for least privilege access.

It's a best practice to require an External ID as part of the trust policy.

EXPERT

James_S

answered 3 years ago

It's a best practice to require an [External ID](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_create_for-user_externalid.html) as part of the trust policy.

Moumita Saha-Security-Specialist · Answer

Check out this github repo where I have tried to build a solution to help you automate user group assignment to permission sets in AWS IAM Identity Center for accessing any or all AWS accounts in your organization via federated access following principles of least privilege- [Automated Role Entitlements in AWS IAM Identity Center](https://github.com/aws-samples/automated-role-entitlements-in-aws-iam-identity-center#automated-role-entitlements-in-aws-iam-identity-center)

How do you automate IAM Role Creation in Customers AWS account?

Relevant content