How to assign a role to an iam user?

Question

I am trying to assign a role to a user using the AWS console but not having a whole lot of success with it. So I created a user David and I created a role with a trust policy in which I am assigning the David i.e. IAM user as the principal which looks like this:

{ "Version": "2012-10-17", "Statement": [ { "Sid": "Statement1", "Effect": "Allow", "Principal": { "AWS": "arn:aws:iam::Account-ID:user/David" }, "Action": "sts:AssumeRole" } ] }

and I also attached a policy to the role which lets the user listbuckets and getobject. The policy looks like this:

{ "Version": "2012-10-17", "Statement": [ { "Sid": "Allowsusertotolistbuckets", "Effect": "Allow", "Action": [ "s3:ListBucket", "s3:GetObject" ], "Resource": "arn:aws:s3:::*" } ] }

Now when I run aws configure and authenticate as David user with the right access key and secret access key and run aws s3 ls. I run into the following: An error occurred (AccessDenied) when calling the ListBuckets operation: Access Denied. How can I have the user assume the role?

You have to attach your IAM Policy to the IAM User for your scenario. The over simplified concept (lot of exceptions apply) to remember is IAM Users is for Humans and IAM Role is for Systems. Also you might also need to work on your bucket policy to enable the the access to the IAM user. — Naveen Vijay
– Naveen Vijay, Commented Oct 22, 2022 at 1:12
@NaveenVijay You're right in the sense that i had to attach the policy but why can't i let the user assume the role? — Somethingwhatever
– Somethingwhatever, Commented Oct 22, 2022 at 1:16

John Rotenstein · Accepted Answer · 2022-10-22 01:33:56Z

IAM Roles are not 'attached' to a user. Rather, an IAM User can be permitted to assume an IAM Role.

Using the AWS CLI, they would assume an IAM Role like this:

aws sts assume-role --role-arn arn:aws:iam::123456789012:role/xaccounts3access --role-session-name s3-access-example

In response, AWS STS will return a set of temporary credentials:

{ "AssumedRoleUser": { "AssumedRoleId": "AROA3XFRBF535PLBIFPI4:s3-access-example", "Arn": "arn:aws:sts::123456789012:assumed-role/xaccounts3access/s3-access-example" }, "Credentials": { "SecretAccessKey": "9drTJvcXLB89EXAMPLELB8923FB892xMFI", "SessionToken": "AQoXdzELDDY//////////wEaoAK1wvxJY12r2IrDFT2IvAzTCn3zHoZ7YNtpiQLF0MqZye/qwjzP2iEXAMPLEbw/m3hsj8VBTkPORGvr9jM5sgP+w9IZWZnU+LWhmg+a5fDi2oTGUYcdg9uexQ4mtCHIHfi4citgqZTgco40Yqr4lIlo4V2b2Dyauk0eYFNebHtYlFVgAUj+7Indz3LU0aTWk1WKIjHmmMCIoTkyYp/k7kUG7moeEYKSitwQIi6Gjn+nyzM+PtoA3685ixzv0R7i5rjQi0YE0lf1oeie3bDiNHncmzosRM6SFiPzSvp6h/32xQuZsjcypmwsPSDtTPYcs0+YN/8BRi2/IcrxSpnWEXAMPLEXSDFTAQAM6Dl9zR0tXoybnlrZIwMLlMi1Kcgo5OytwU=", "Expiration": "2016-03-15T00:05:07Z", "AccessKeyId": "ASIAJEXAMPLEXEG2JICEA" } }

These credentials can then be used to call AWS service 'as the IAM Role' rather than 'as the IAM User'.

See: assume-role — AWS CLI Command Reference

To make things easier, it is possible to define a profile that uses an IAM Role. The AWS CLI will automatically use IAM User credentials to call AssumeRole(), then use the resulting credentials to make the desired API call.

Here is an example profile entry:

[profile marketingadmin] role_arn = arn:aws:iam::123456789012:role/marketingadminrole source_profile = user1

This is saying: "Use the IAM User credentials from profile user1 to call AssumeRole() on the marketingadminrole"

It can then be used like this:

aws s3 ls s3://marketing-bucket --profile marketingadmin

See: Using an IAM role in the AWS CLI - AWS Command Line Interface

Collectives™ on Stack Overflow

How to assign a role to an iam user?

1 Answer 1

Comments

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

Comments

Related