1

I want to enforce users to use their IAM username as the role session name when assuming a role in AWS. I've tried the following condition in IAM policies:

{
  "Effect": "Allow",
  "Principal": {
    "AWS": "arn:aws:iam::<redacted>:root"
  },
  "Action": "sts:AssumeRole",
  "Condition": {
    "StringLike": {
      "sts:RoleSessionName": "${aws:username}"
    }
  }
}

While this works fine when assuming a role as a user it does not work when assuming a role from a role with administrator privileges (Allow * on *). The only way to block this would be an explicit Deny when a role tries to assume a given role and does not have session name set up. Any ideas how to write a policy doing this? A simple Deny like below does not work because aws:username is not present when Assumed Role is the principal (see docs).

{
  "Effect": "Deny",
  "Principal": {
    "AWS": "arn:aws:iam::<redacted>:root"
  },
  "Action": "sts:AssumeRole",
  "Condition": {
    "StringNotLike": {
      "sts:RoleSessionName": "${aws:username}"
    }
  }
}
1

I have not tried it but I think if you change your deny to a list of elements it will work.

{
  "Effect": "Deny",
  "Principal": {
    "AWS": "arn:aws:iam::<redacted>:root"
  },
  "Action": "sts:AssumeRole",
  "Condition": {
    "StringNotLike": {
      "sts:RoleSessionName": [
        "${aws:username}",
        "AnotherAllowedName"
      ]
    }
  }
}

This will allow an IAM user to assume the role if they use their username as the session name and it will also allow other Principals to assume the role if they use "AnotherAllowedName" as the session name but all other session names would be declined. I found this AWS blog post helpful when researching this answer

2
  • I'm afraid it does not solve my problem. I want the role session name to match username. AnotherAllowedName would not fulfill this requirement. – pmichna Sep 1 '20 at 20:47
  • @pmichna Then I dont think it will be possible. As you said, the ${aws:username} variable is only available when IAM users are the principal. If your usernames in AWS contain your companies domain you might be able to do something like "*@mycompany.com" which might remind them they need to use their emails. – Levi Sep 2 '20 at 10:04

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.