AWS assign external role to instance - amazon-web-services

Question

I have a program that goes through many accounts and does inventory. Right now it is using boto3 and AWS keys.
I would like to move away from aws keys and instead assign role to an instance and use that role to switch accounts.
I know how to assign external role to a user, but I have no idea how to do that with an instance role.
The idea here is to do something like this:
Get list of all accounts from main organization account
For each account assume role with ec2 (and other service) describe role
Get inventory
Switch role to another account.
Any ideas how to accomplish this?

Answer 1

Your method is sound. You would do it as follows:
Create a Main Role in the main account.
Assign this role to the Amazon EC2 instance being used to gather the inventory.
Create a Target IAM Role in each target account.
Assign sufficient permissions to each Target Role to allow the inventory (eg Describe* calls)
Edit the Trust Policy on each Target Role to permit the Main Role to use the Target Role
Your application can then use the Main Role (assigned to the EC2 instance) to call AssumeRole() on each of the Target Roles in the child accounts (as per your step 2).
Thus, your flow is really:
Get list of all accounts from main organization account
For each account:
Assume Role on the target role
Get inventory

Answer 2

You can call org API to list accounts first and the same way you can call for each account with cross-account role
Make sure your Ec2 role has sufficient permissions to assume role for child account
def get_accounts():
sts_role = 'arn:aws:iam::XXX:role/AWSAudit_CrossOrgAccess' # Org Billing API
assumedRoleObject = sts.assume_role(RoleArn=str(sts_role), RoleSessionName="accounts_watcher_lambda" )
credentials = assumedRoleObject['Credentials']
conn = boto3.client( 'organizations', aws_access_key_id=credentials['AccessKeyId'], aws_secret_access_key=credentials['SecretAccessKey'], aws_session_token=credentials['SessionToken'],)
list_of_accounts = conn.list_accounts()
return list_of_accounts```
## Your Ec2 role looks like
`
YourServerEc2Profile:
Type: AWS::IAM::InstanceProfile
Properties:
Path: '/'
Roles:
- Ref: YourServerEc2Role
YourServerEc2Role:
Type: AWS::IAM::Role
Properties:
AssumeRolePolicyDocument:
Version: '2012-10-17'
Statement:
- Effect: Allow
Principal:
Service:
- ec2.amazonaws.com
Action:
- sts:AssumeRole
Path: "/"
Policies:
-
PolicyName: AuditInstall
PolicyDocument:
Version: "2012-10-17"
Statement:
-
Action:
- "ssm:*",
- "ec2:DescribeImages",
- "cloudwatch:PutMetricData",
- "ec2:DescribeInstances",
- "lambda:InvokeFunction",
- "ec2:DescribeTags",
- "ec2:DescribeVpcs",
- "cloudwatch:GetMetricStatistics",
- "ec2:DescribeSubnets",
- "ec2:DescribeKeyPairs",
- "cloudwatch:ListMetrics",
- "ec2:DescribeSecurityGroups"
Resource: "*"
Effect: "Allow"
ManagedPolicyArns:
- !Ref YourServerCrossAccount
- arn:aws:iam::aws:policy/ReadOnlyAccess
YourServerCrossAccount:
Type: AWS::IAM::ManagedPolicy
Properties:
PolicyDocument:
Version: '2012-10-17'
Statement:
- Effect: Allow
Action:
- sts:AssumeRole
Resource:
- arn:aws:iam::XXX:role/AWS_CrossAccount
`