I have two accounts A and B. I have a service in Account B that writes its logs to CloudWatch. In account A I have a AWS lambda that periodically needs to run a CloudWatch insights query to retrieve logs that match a pattern.
I can't seem to find a way to setup permissions for this or how to make a cross account cloud watch query from Lambda in Account A to CloudWatch logs in Account B. Is this even possible? If so, how?
You can do it, using cross-account access IAM role, assuming the role from the B account.
A good detailed explanation with examples can be found here.
Essentially, you have to assume a role from account B which allows your Lambda function in account A to access certain resources in account B. In the trust policy of the IAM role your AWS account A ID has to be set, so your Lambda can access resources based on what the account B policy allows.
Related
We have an AWS account with an IAM group, this group contains practically 6 users and most operations in the account are done by this 6 users.
There are 12 Lambda Functions that have been created in the account and there is a particular lambda function (created by one of the 6 users) that I am trying to know who created it (The Lambda function owner).
Please is there a way to do this ?
Resources created in AWS Accounts are associated with the Account, not the IAM User that created the account.
When a user requests AWS to create resources, IAM verifies that the user has permission to create resources. If so, then the resources are created in the Account, but no relationship with the user is kept on that resource.
You can, however, use AWS CloudTrail to view information about the API request that created the resource.
From What Is AWS CloudTrail? - AWS CloudTrail:
AWS CloudTrail is an AWS service that helps you enable governance, compliance, and operational and risk auditing of your AWS account. Actions taken by a user, role, or an AWS service are recorded as events in CloudTrail. Events include actions taken in the AWS Management Console, AWS Command Line Interface, and AWS SDKs and APIs.
Started recently understanding AWS IAM Roles, Groups, Roles and Permissions.
I understood that groups will be added with some Permissions and whoever the users got added into that group, will have an access to those specific AWS services provided in that group. Where as Role is used to provide an access from one Service to Other. (Say Lambda wants to have an access for CloudWatch).
My Query is: Suppose if Group (say 'dev') have added only 2 Permissions policy (say S3FullAccess, LambdaFullAccess)
and Role created for Lambda Service (having Permission policy "cloudwatchFullAccess"), then does a user from 'dev' group can able to access 'cloudwatch' service?
EDIT:
Another query: I didnt understood on How do we map Users/Groups to only specific Roles? orelse does Roles can be accessed by every user/group (assuming Permission policies already added in Groups of those services mentioned in the Roles)? Please clear me this too
The permissions from the role are only allowed by a principal (IAM user/IAM role/AWS Service) that has assumed the role. If your user had the permission to assume that IAM role and did it, then yes they would have those permissions.
However based on the policies they have they cannot assume the role, but Lambda (assuming it has a trust policy in place) can assume the IAM role in question.
This means that Lambda can perform any CloudWatch interactions, which would allow a user within the dev group to add code that interacts with CloudWatch within the Lambda function and then when triggering the Lambda function see the output of it.
They would not however be able to see the CloudWatch interface within the console, or directly interact with it on the AWS CLI.
To explain the difference between users, groups and role:
An IAM user is an entity with which you can interact directly through the console or CLI. It requires credentials to perform these interactions and gains its permissions from policies. It is generally advised not to use these for applications that reside in AWS.
An IAM group is an entity to group similar IAM users, providing them the same permissions. This allows a hierarchy to be easily maintained. No entity can become a group, it is an assignment to an IAM user.
An IAM role is similar to a user, in that it can interact with the console or CLI. However, to do this it must be assumed, which will provide the entity that assumed it with temporary credentials. An AWS service that assumes the role manages these temporary credentials for you.
For a user to assume the role, 2 things would need to be in place. The role would need to have a trust policy that enables the principal of the IAM user (or account) to assume that role. In addition the user would need to have permission to perform the sts:AssumeRole action on the IAM role resource.
More information about this can be found in the Granting a User Permissions to Switch Roles
documentation.
Consider 2 AWS accounts A ( Other team ) and B ( Mine )
For my use case, I have to poll to queues in A's AWS account for payload and perform database operations in B.
To do this, I have a role created in B having access to my databases + A's account ID as trusted relationship.
Likewise A has created a role for granting access to queue in A + added B as trusted relationship.
Code for doing all the polling + database action will reside on EC2 in my account ( B ).
Now how do I consume payloads and perform operations from a role's perspective. Is my understanding correct?
Assume role A
Poll to provisioning queue, get the JSON payload from SQS
Assume role B
Perform database operations in Oracle RDS
Assume role A
Return back the response to response SQS
Start polling again on provisioning queue SQS
FYI : I am performing the above operations using Python + Boto3
Instead of assuming roles, you can grant Cross-Account access to the queues in Account A to the user/role in Account B.
In your case, grant it to EC2 instance role and then you'll be able to do all the required operations from within the instance without any "Assume role" tricks.
You don't say which programming language or SDK you are using, but essentially you can create two client/service objects, one leveraging credentials from role A and the other from role B. Then simply make API calls using the appropriate client/service object.
Using boto3, for example:
sqs_accounta = boto3.client(
'sqs',
region_name='us-east-1',
aws_access_key_id=xxx,
aws_secret_access_key=yyy,
aws_session_token=zzz
)
rds_accountb = boto3.client(
'rds',
region_name='us-west-2',
aws_access_key_id=aaa,
aws_secret_access_key=bbb,
aws_session_token=ccc
)
Pretend for a moment that everything was happening in your own account (Account-B).
You would give a set of credentials to your code (either an IAM User or, if the code is running on an Amazon EC2 instance, you would assign an IAM Role to the instance) that it can use to access the necessary resources in Account B. So, no problem there.
The only additional requirement is that you wish to access Amazon SQS in Account-A. It so happens that you can add permissions directly to an Amazon SQS queue that grants cross-account access.
See: Basic Examples of IAM Policies for Amazon SQS - Amazon Simple Queue Service
So, you do not actually need to assume any roles. Just use the normal credentials that are assigned to your code, and add permissions to the SQS queue to allow that particular IAM User or IAM Role to use the queue.
I have two aws accounts. I have a user in account a which needs to have full access to aws data pipeline in account B.
How to achieve this?
I have attached a policy to the user in account A to have access to data pipeline.
But how do I attach a policy to datapipeline in account B so that it accepts requests from this user from account A?
AWS STS with Assume Role will let you setup with cross account resource access. There is a very descriptive video by AWS to help understand & setup the same. For your case, instead of EC2 you will just give Datapipeline access.
I understand the difference between roles and policies but the question
is why these two exists?
I mean why not use AWS Services with Policies?
thanks
IAM roles are similar to IAM users. We create roles to execute operations on required AWS Service.
For example: We can create a role that can perform a write operation
on DynamoDB table and assign that role to a lambda function. Then the
lambda function can use this role's privilege to write something on
DynamoDB.
Policies are simply JSON documents in which we can specify permissions: operations can be allowed or denied. Policies are attached to IAM identities such as users, groups and roles.
So the question is why both exists, why not use AWS service with Policies. The simple answer is we actually are using the AWS services with policies but in the name of IAM user or roles.
Policies get assigned to Roles. Roles do nothing on their own. You should use roles for services for simplicity and security. When assigning roles to a service you don't need to provide AWS access keys directly to these services anymore since they will be provided to the environment by the role. This is much more secure and simple then needing to pass these items to a service or application running on AWS and needing to secure them both on the service and in code.