- Published on
Setup AWS S3 Cross Account Access
- Authors
- Name
- Ruan Bekker
- @ruanbekker
In this tutorial I will demonstrate how to setup cross account access from S3.
Scenario
We will have 2 AWS Accounts:
a Green AWS Account which will host the IAM Users, this account will only be used for our IAM Accounts.
a Blue AWS Account which will be the account that hosts our AWS Resources, S3 in this scenario.
We will the allow the Green Account to access the Blue Account's S3 Bucket.
Setup the Blue Account
In the Blue Account, we will setup the S3 Bucket, as well as the Trust Relationship with the Policy, which is where we will define what we want to allow for the Green Account.
Now we need to setup the IAM Role which will allow the Green Account and also define what needs to be allowed.
Go ahead to your IAM Console and create a IAM Policy (just remember to replace the bucket name if you are following along)
{
"Version": "2012-10-17",
"Statement": [
{
"Sid": "PutGetListAccessOnS3",
"Effect": "Allow",
"Action": [
"s3:PutObject",
"s3:GetObject",
"s3:ListBucket"
],
"Resource": [
"arn:aws:s3:::ruanbekker-prod-s3-bucket",
"arn:aws:s3:::ruanbekker-prod-s3-bucket/*"
]
}
]
}
In my case I have named my IAM Policy CrossAccountS3Access
. After you have created your IAM Policy, go ahead and create a IAM Role. Here we need the source account that we want to allow as a trusted entity, which will be the AWS AccountId of the Green Account:
Associate the IAM Policy that you created earlier:
After you have done that, you should see a summary screen:
Make note of your IAM Role ARN, it will look something like this: arn:aws:iam::xxxxxxxxxxxx:role/CrossAccountS3Access-Role
Setup the Green Account
In the Green Account is where we will create the IAM User and the credentials will be provided to the user which requires to access the S3 Bucket.
Let's create a IAM Group, I will name mine prod-s3-users
. I will just create the group, as I will attach the policy later:
From the IAM Group, select the Permissions tab and create a New Inline Policy:
Select the "STS" service, select the "AssumeRole" action, and provide the Role ARN of the Blue Account that we created earlier:
 and select the "Programmatic Access" check box as we need API keys as we will be using the CLI to access S3:
