How would you access data in an S3 bucket from Account A when your application is running on an EC2 instance in Account B?

Posted by

 To access data in an S3 bucket from Account A when your application is running on an EC2 instance in Account B, you can set up cross-account access using AWS Identity and Access Management (IAM) roles and policies. Here is a step-by-step guide on how to achieve this:

Step 1: Create an IAM Role in Account A

  1. Sign in to the AWS Management Console for Account A.

  2. Navigate to the IAM Service.

  3. Create a New Role:

    • Click on "Roles" and then "Create role."
    • Select "Another AWS account" and enter the Account ID of Account B.

  4. Attach a Policy to the Role:

    • Attach a policy that grants the necessary permissions to access the S3 bucket. For example, you can use a policy like this:

      json
      {
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "s3:GetObject",
        "s3:ListBucket"
      ],
      "Resource": [
        "arn:aws:s3:::your-bucket-name",
        "arn:aws:s3:::your-bucket-name/*"
      ]
    }
  ]
}

  5. Trust Relationship:

    • Modify the trust relationship to allow Account B to assume this role. It should look something like this:

      json
      {
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": {
        "AWS": "arn:aws:iam::AccountB-ID:root"
      },
      "Action": "sts:AssumeRole"
    }
  ]
}

Step 2: Create an IAM Role in Account B

  1. Sign in to the AWS Management Console for Account B.
  2. Navigate to the IAM Service.
  3. Create a New Role:
    • Click on "Roles" and then "Create role."
    • Select "AWS service" and then "EC2."
  4. Attach a Policy to the Role:

    • Attach a policy that allows the EC2 instance to assume the role in Account A. The policy might look like this:

      json
      {
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": "sts:AssumeRole",
      "Resource": "arn:aws:iam::AccountA-ID:role/RoleName"
    }
  ]
}

Step 3: Launch an EC2 Instance with the IAM Role in Account B

  1. Launch a new EC2 instance or modify an existing one:
    • In the "IAM role" section, select the IAM role you created in Account B.

Step 4: Access the S3 Bucket from the EC2 Instance in Account B

  1. Assume the Role from the EC2 Instance:

    • Use the AWS SDK or CLI to assume the role from Account A and access the S3 bucket. Here’s an example using the AWS CLI:

      sh
      aws sts assume-role --role-arn arn:aws:iam::AccountA-ID:role/RoleName --role-session-name MySession

    • This command will return temporary security credentials (AccessKeyId, SecretAccessKey, and SessionToken) that you can use to interact with the S3 bucket.

  2. Use Temporary Credentials to Access S3:

    • Configure the AWS CLI or SDK with the temporary credentials:

      sh
      aws configure set aws_access_key_id <AccessKeyId>
aws configure set aws_secret_access_key <SecretAccessKey>
aws configure set aws_session_token <SessionToken>

    • Access the S3 bucket:

      sh
      aws s3 ls s3://your-bucket-name

Summary

  1. Create an IAM role in Account A with S3 access permissions and allow Account B to assume it.
  2. Create an IAM role in Account B that allows EC2 to assume the role from Account A.
  3. Launch an EC2 instance in Account B with the assigned IAM role.
  4. Use the AWS CLI or SDK on the EC2 instance to assume the role from Account A and access the S3 bucket using the temporary credentials.

This setup ensures secure cross-account access to S3 resources while adhering to AWS best practices.

Devops