2

Is it possible to run aws cli from ec2 to create some resources in another account without using aws_secret_key and aws_access_key?

3

Supposing the scenario with two accounts A & B the explanatory steps should be:

  1. In account A, I created a role (e.g RoleForB) to trust account B, and attach to the before created role a IAM policy to allow it to perform some read operations in account A. e.g ReadOnlyAccess
  2. In account B, I created a role (e.g AssumeRoleInA) and attach a policy to allow it to assume the role that is created in account A.
  3. In account B Associate to your EC2 instance ec2-profile the IAM role (AssumeRoleInA) created in step 2.
  4. In account B login into this EC2 instance to assume the role in Account A using the command aws sts assume-role --role-arn "arn:aws:iam::Account_A_ID:role/RoleForB" --role-session-name "EC2FromB".
  5. In account B EC2 terminal when the command is step 4. finished, you can see the access key ID, secret access key, and session token from wherever you've routed it, in our case stdout either manually or by using a script. You can then assign these values to environment variables (AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY, AWS_SESSION_TOKEN)

So Let’s check the configurations mentioned above step by step but with some mode detail:

  1. As before presented in account A, it builds the trust to account B by creating the role named RoleForB and attaching ReadOnlyAccess permission to it.
{
    "Version": "2012-10-17",
    "Statement": {
        "Effect": "Allow",
        "Principal": {"AWS": "arn:aws:iam::Account_B_ID:root"},
        "Action": "sts:AssumeRole"
    }
}
  1. In account B, create a role named AssumeRoleInA then attach the corresponding policy to allow it to assume the role named RoleForB in account A.
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": "sts:AssumeRole",
      "Resource": [
        "arn:aws:iam::Account_A_ID:role/RoleForB"
      ]
    }
  ]
}
  1. In account B, create a new EC2 instance (if it does not exists yet), and associate it's ec2-profile with the IAM role named AssumeRoleInA.
{
    "Version": "2012-10-17",
    "Statement": {
        "Effect": "Allow",
        "Principal": {"Service": "ec2.amazonaws.com"},
        "Action": "sts:AssumeRole"
    }
}
  1. In account B login into this EC2 instance to assume the role in Account A using the command:
aws sts assume-role --role-arn "arn:aws:iam::Account_A_ID:role/RoleForB" --role-session-name "EC2FromB"`

eg:

jenkins@bb-jenkins-vault:~$ aws sts assume-role --role-arn arn:aws:iam::521111111144:role/DeployMaster --role-session-name "project-dev-jenkins-deploy"
{
    "AssumedRoleUser": {
        "AssumedRoleId": "AROAJBXGEHOQBXGEHOQ:project-dev-jenkins-deploy", 
        "Arn": "arn:aws:sts::521111111144:assumed-role/DeployMaster/project-dev-jenkins-deploy"
    }, 
    "Credentials": {
        "SecretAccessKey": "wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY", 
        "SessionToken": "FQoGZXIvYXCUm8iG6/zLdQ7foognvCDpxKP7cRJiZgc...CUm8iG6/zLdQ7foognvCDpxKP7c+OQF", 
        "Expiration": "2019-03-29T15:41:02Z", 
        "AccessKeyId": "AKIAI44QH8DHBEXAMPLE"
    }
}
  1. In account B EC2 terminal when the command is step 4. finished, you can see the access key ID, secret access key, and session token from wherever you've routed it, in our case stdout either manually or by using a script. You can then assign these values to environment variables
$ export AWS_ACCESS_KEY_ID=AKIAI44QH8DHBEXAMPLE
$ export AWS_SECRET_ACCESS_KEY=wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY
$ export AWS_SESSION_TOKEN=FQoGZXIvYXCUm8iG6/zLdQ...<remainder of security token>
$ aws ec2 describe-instances --region us-east-1

credit: https://stackoverflow.com/a/55420220/6657158

| improve this answer | |
2

Sure, if the EC2 role allows STS::AssumeRole you can assume a role in the other account and get temporary credentials to do whatever you need to do in the other account.

See for example here: Cross Account Access with AWS-CLI

| improve this answer | |
  • Thank you Mlu. I don't want to use access_key and secret_key inside ec2. Is it possible without aws config file(aws/credential) has access to other accounts? – Pzowghi Apr 5 '19 at 3:29
  • @Pzowghi AWS-CLI can use your EC2 IAM Role to get local credentials and then use those to assume role in the other account to get temporary creds from there. No access/secret keys on the filesystem involved. – MLu Apr 5 '19 at 3:32
  • I understand the concept. You shared the solution but there are access and secret key in that. If I don't have aws/credentials and aws/config how I could have different profiles for different accounts? – Pzowghi Apr 5 '19 at 3:43
  • @Pzowghi Ah, true. Skip that first step, aws-cli will get the creds from EC2 IAM role by default. – MLu Apr 5 '19 at 3:46

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.