3

I'm looking for a service or third party solution that allows for granting temporary access to an IAM user (or group) to one or more services in an AWS account.

The example I have is there is an outage in a production account, and I would like to grant temporary access to developers/sys admins to resolve the issue. Under normal circumstances, they would not have access to this particular service/account.

Ideally, I would like this to me a managed off the shelf solution vs something like STS, which would require quite a bit of configuration. Example, a system outage occurs for unknown reasons in a production account that the on call SRE does not normally have access to. A manager or lead should quickly be able to temporarily escalate privileges for the user until the "firefight" is resolved.

Improve this question
2
  • 1
    Just to clarify, these developers and sysadmins already have either (a) an IAM User in the same AWS account, but with limited access, or (b) an IAM User in a different AWS account, correct? Also, do you have any existing products with an employee directory? G Suite or Active Directory, for example? This may help identify a third-party tool to integrate with.
    – Woodland
    Commented Jun 23, 2020 at 21:54
  • A or B can be assumed, it doesn't matter. I would like to stick to limiting it to within the AWS ecosystem.
    – Preston Martin ♦
    Commented Jun 25, 2020 at 4:20

2 Answers 2

Reset to default
1
  1. Create an IAM role in prod with all the permissions you'd like the devs to have.
  2. When you want devs to have prod access, add the sts:AssumeRole permission to their IAM group.
  3. When it's time to revoke access, remove the sts:AssumeRole permission.

More details in my blog article here.

Improve this answer
1
  • Sorry Harish, I accidentally put SSM instead of STS in my question. I've corrected the question. What I'm looking for is a simpler managed solution rather than using the native STS functionality that AWS offers. The solution could use STS in the backend, but I'm looking for something that would require less management of the role structures. Ideally, something that could be quickly implemented by either a manager or lead could activate when a system outage occurs. I've added an example for clarification.
    – Preston Martin ♦
    Commented Jun 29, 2020 at 0:15
0

It would be better to use the official docs as trusted source :) AWS Official Docs

Improve this answer
2
  • What do you mean?
    – Preston Martin ♦
    Commented Jun 30, 2020 at 20:29
  • Create role with trusted relations to the users which must have temporarily permissions to the services you want. STS token typically lives 3 hours by default, but you can manage it
    – Hakob
    Commented Jun 30, 2020 at 20:42

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.