3

I'm looking for a service or third party solution that allows for granting temporary access to an IAM user (or group) to one or more services in an AWS account.

The example I have is there is an outage in a production account, and I would like to grant temporary access to developers/sys admins to resolve the issue. Under normal circumstances, they would not have access to this particular service/account.

Ideally, I would like this to me a managed off the shelf solution vs something like STS, which would require quite a bit of configuration. Example, a system outage occurs for unknown reasons in a production account that the on call SRE does not normally have access to. A manager or lead should quickly be able to temporarily escalate privileges for the user until the "firefight" is resolved.

  • 1
    Just to clarify, these developers and sysadmins already have either (a) an IAM User in the same AWS account, but with limited access, or (b) an IAM User in a different AWS account, correct? Also, do you have any existing products with an employee directory? G Suite or Active Directory, for example? This may help identify a third-party tool to integrate with. – Woodland Hunter Jun 23 at 21:54
  • A or B can be assumed, it doesn't matter. I would like to stick to limiting it to within the AWS ecosystem. – PrestonM Jun 25 at 4:20
0
  1. Create an IAM role in prod with all the permissions you'd like the devs to have.
  2. When you want devs to have prod access, add the sts:AssumeRole permission to their IAM group.
  3. When it's time to revoke access, remove the sts:AssumeRole permission.

More details in my blog article here.

| improve this answer | |
New contributor
Harish KM is a new contributor to this site. Take care in asking for clarification, commenting, and answering. Check out our Code of Conduct.
  • Sorry Harish, I accidentally put SSM instead of STS in my question. I've corrected the question. What I'm looking for is a simpler managed solution rather than using the native STS functionality that AWS offers. The solution could use STS in the backend, but I'm looking for something that would require less management of the role structures. Ideally, something that could be quickly implemented by either a manager or lead could activate when a system outage occurs. I've added an example for clarification. – PrestonM Jun 29 at 0:15
0

It would be better to use the official docs as trusted source :) AWS Official Docs

| improve this answer | |
  • What do you mean? – PrestonM Jun 30 at 20:29
  • Create role with trusted relations to the users which must have temporarily permissions to the services you want. STS token typically lives 3 hours by default, but you can manage it – Hakob Jun 30 at 20:42

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.