I was trying to create an IAM role for S3 bucket, I have to select a role type from a list of AWS services, but I can't find "Amazon Simple Storage Service (S3)" anywhere. any proposed solutions?
Here is a screenshot from the page involved.
Related
I'm trying to understand the AWS Amplify documentation section "Using Amazon S3". It says:
If you set up your Cognito resources manually, the roles will need to be given permission to access the S3 bucket.
There are two roles created by Cognito: an Auth_Role that grants signed-in-user-level bucket access and an Unauth_Role that allows unauthenticated access to resources. Attach the corresponding policies to each role for proper S3 access. Replace {enter bucket name} with the correct S3 bucket.
And then the docs provide JSON examples of Policies for Auth_Role and Unauth_Role. What's confusing me is that when I go into my Roles in my IAM console, I have the following:
amplify--dev-153155-authRole (contains AppSync resources)
amplify--dev-153155-authRole-idp (log group resources)
amplify--dev-153155-unauthRole (empty)
Neither of which contain anything like the JSON examples. The "...authRole" Policy contains actions/resources concerning AppSync, but nothing to do with S3. Likewise for the other two. I expected to find permissions to allow my Amplify app to get/store S3 items, otherwise how is it able to currently do it?
So my questions are:
How do I create and attach the policies provided in the above documentation? Do I simply paste the JSON into new policies in my IAM console, and attach them to the Auth_Role?
Where are the default permissions stored? I have set up an amplify app and added S3 with amplify add storage. I can connect to the S3 bucket to add and retrieve files - so presumably there must be existing Polices. But my Auth_Role contains no Policies that reference S3?
Requirement: Create SakeMaker GroundTruth labeling job with input/output location pointing to S3 bucket in another AWS account
High Level Steps Followed: Lets say, Account_A: SageMaker GroundTruth labeling job and Account_B: S3 bucket
Create role AmazonSageMaker-ExecutionRole in Account_A with 3 policies attached:
AmazonSageMakerFullAccess
Account_B_S3_AccessPolicy: Policy with necessary S3 permissions to access S3 bucket in Account_B
AssumeRolePolicy: Assume role policy for arn:aws:iam::Account_B:role/Cross-Account-S3-Access-Role
Create role Cross-Account-S3-Access-Role in Account_B with 1 policy and 1 trust relationship attached:
S3_AccessPolicy: Policy with necessary S3 permissions to access S3 bucket in the this Account_B
TrustRelationship: For principal arn:aws:iam::Account_A:role/AmazonSageMaker-ExecutionRole
Error: While trying to create SakeMaker GroundTruth labeling job with IAM role as AmazonSageMaker-ExecutionRole, it throws error AccessDenied: Access Denied - The S3 bucket 'Account_B_S3_bucket_name' you entered in Input dataset location cannot be reached. Either the bucket does not exist, or you do not have permission to access it. If the bucket does not exist, update Input dataset location with a new S3 URI. If the bucket exists, give the IAM entity you are using to create this labeling job permission to read and write to this S3 bucket, and try your request again.
In your high level step 2, the approach should change to using a Resource Policy on your S3 bucket that allows account A to write to it. Rather than expecting Account A to assume a role in Account B, which I don't believe Sagemeker will do. Therefore the general approach is to do the following:
Account A Sagemaker service is given has a iam policy with a that allows access to Account B bucket. (Basically what you've done).
Account B bucket is given a resource policy that allows Account A to access it.
The following article gives additional help on this topic: How can I provide cross-account access to objects that are in Amazon S3 buckets?
Reverted back to original approach where access to the SageMaker execution role was provided through direct S3 bucket policy.
While creating the GT job from console:
(i) Expects the user creating the job also to have access to the data in cross account S3 bucket; Updated bucket policy to have access for both SageMaker execution role as well as user
(ii) Expects the manifest in own account's S3 bucket; Fails with 403 if manifest is in cross account S3 bucket even though SageMaker execution role had access to the cross account S3 bucket
While creating the GT job from CLI: Above restrictions doesn't apply and was able to create the GT job.
I always get confused in two but I wanted to add a IAM policy on S3 bucket.
Basically I have created an output bucket for Amazon transcriptions but it seems I need to add IAM role to allow Transcription job to write to the bucket. I think if I can attach AmazonTranscribeFullAccess to S3 bucket, it will work but I am unable to attach this policy. Could you please advise how can I add this policy on the new bucket?
There are a few concepts you will want to dig deeper into to understand the difference between IAM policies and S3 bucket policies. A detailed guide is: https://docs.aws.amazon.com/AmazonS3/latest/dev/how-s3-evaluates-access-control.html
You can attach IAM policies to Users, Groups and Roles, and you can attach bucket policies to S3 buckets.
Try adding S3 access to the user/role that you are using to run the transcribe job.
Since Lightsail instances are hosted from a dedicated AWS account different from the user's account, what would be a good S3 bucket policy to restrict bucket/object actions for a specific Lightsail instance? Specifically, I would like to grant only s3:PutObject and s3:ListBucket actions to the instance.
Or, is there another, better solution for granting access than the bucket policy?
Since Lightsail is managed outside, you can create a IAM User (Not IAM Role) and attach IAM Policy to it in the AWS account where the private S3 bucket resides.
Then use the AWS IAM User's programmatic access cresentials from you Lightsail instance to access S3.
Everywhere I can see IAM Role is created on EC2 instance and given Roles like S3FullAccess.
Is it possible to create IAM Role on S3 instead of EC2? And attach that Role to S3 bucket?
I created IAM Role on S3 with S3FULLACCESS. Not able to attach that to the existing bucket or create a new bucket with this Role. Please help
IAM (Identity and Access Management) Roles are a way of assigning permissions to applications, services, EC2 instances, etc.
Examples:
When a Role is assigned to an EC2 instance, credentials are passed to software running on the instance so that they can call AWS services.
When a Role is assigned to an Amazon Redshift cluster, it can use the permissions within the Role to access data stored in Amazon S3 buckets.
When a Role is assigned to an AWS Lambda function, it gives the function permission to call other AWS services such as S3, DynamoDB or Kinesis.
In all these cases, something is using the credentials to call AWS APIs.
Amazon S3 never requires credentials to call an AWS API. While it can call other services for Event Notifications, the permissions are actually put on the receiving service rather than S3 as the requesting service.
Thus, there is never any need to attach a Role to an Amazon S3 bucket.
Roles do not apply to S3 as it does with EC2.
Assuming #Sunil is asking if we can restrict access to data in S3.
In that case, we can either Set S3 ACL on the buckets or the object in it OR Set S3 bucket policies.