aws cli assume role

2 min read 11-11-2024

Mastering AWS CLI: Assuming Roles for Enhanced Security

In the world of cloud computing, security is paramount. AWS offers the powerful aws command-line interface (CLI) to manage resources, but often you need temporary elevated privileges for specific tasks. This is where assuming roles comes in. This article will guide you through the process of assuming roles with the AWS CLI, explaining its benefits and providing practical examples.

Why Assume Roles?

Imagine a scenario where you need to interact with a highly sensitive AWS account for a limited time. Directly granting full access to this account poses a significant security risk. This is where assuming roles provides a crucial solution:

Temporary Permissions: Roles grant specific, time-bound permissions, minimizing the risk of unauthorized access.
Principle of Least Privilege: Users are granted only the permissions they need to perform their tasks, enhancing security and compliance.
Granular Control: Define granular access control for individual tasks, ensuring no unnecessary privileges are granted.

Understanding Roles

A role is an IAM (Identity and Access Management) entity that acts as a temporary set of permissions. It defines the specific actions a user or service can perform in a given AWS account. Unlike users, roles don't have their own credentials; instead, they are assumed by users or services for the duration of a task.

The Process of Assuming Roles

The process involves two key steps:

Creating a Role: Define the permissions the role should have, specifying what actions it can perform and on which resources.
Assuming the Role: Use the AWS CLI to temporarily assume the role, obtaining temporary credentials.

Using the AWS CLI to Assume Roles

Here's a breakdown of the process:

Obtain Role ARN: The Amazon Resource Name (ARN) identifies the role you wish to assume. This ARN is usually provided to you.
Use aws sts assume-role Command: Execute the following command:
```
aws sts assume-role --role-arn <role-arn> --role-session-name <session-name>
```
- <role-arn>: Replace with the actual ARN of the role.
- <session-name>: Choose a descriptive name for your temporary session.

Extract Temporary Credentials: The output will include your temporary credentials:

{
  "Credentials": {
    "AccessKeyId": "AKIAXXXXXXXXXXXXXXXX",
    "SecretAccessKey": "XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX",
    "SessionToken": "AQoDYXdzEAAAA...==" 
  },
  ...
}

Utilize Temporary Credentials: Use these credentials to interact with AWS services through the CLI:

aws s3 ls --aws-access-key-id <AccessKeyId> --aws-secret-access-key <SecretAccessKey> --aws-session-token <SessionToken>

Example: Assuming a Role for S3 Access

Let's say you need to access a specific S3 bucket for a specific project. You can assume a role with permissions limited to that bucket:

Create Role: In the IAM console, create a role named "S3Access" and attach the "AmazonS3FullAccess" policy.
Get Role ARN: Obtain the ARN of the "S3Access" role.

Assume Role: Use the aws sts assume-role command to assume the "S3Access" role:

aws sts assume-role --role-arn arn:aws:iam::<account-id>:role/S3Access --role-session-name s3-access-session

Access S3 Bucket: Use the extracted temporary credentials to list the contents of your S3 bucket:

aws s3 ls s3://<bucket-name> --aws-access-key-id <AccessKeyId> --aws-secret-access-key <SecretAccessKey> --aws-session-token <SessionToken>

Conclusion

Assuming roles with the AWS CLI is a critical practice for securing your cloud environment. It enables you to delegate temporary access with granular control, ensuring only authorized users have the necessary privileges. By embracing this approach, you strengthen your security posture and maintain compliance with best practices.