Cross-account access in AWS

Organizations opt to use multiple AWS accounts for a variety of reasons including:

• Cost management
• Constrain access to sensitive information
• Reduce the impact of breaches
• Logically grouping workloads by business units

Users and groups within one AWS account will often need to access resources in another AWS account. Instead of creating separate IAM users and groups in each account, access can be delegated to IAM users and groups in a different AWS account using cross-account IAM roles. Certain services also provide resource-based policies to allow access across accounts. This lab walks through the mechanics of configuring and using cross-account roles and resource-based policies, specifically S3 bucket policies. Policy evaluation logic is also discussed.

Learning objectives

Upon completion of this intermediate-level lab, you will be able to:

• Understand how cross-account roles are configured
• Assume different roles in the AWS Management Console
• Assume different roles using the AWS CLI
• Understand and configure Amazon S3 bucket policies in the context of cross-account access
• Describe the policy evaluation logic flow in AWS

Intended audiences

• AWS Security Engineers
• Cloud practitioners
• AWS Account Administrators

Prerequisites

Familiarity with the following is recommended:

• Basic IAM entities (users, user groups, policies, roles)
• Basic Amazon S3 concepts (buckets, objects)

The following content can be used to fulfill the prerequisite:

• How AWS IAM is Used to Securely Manage Access
• Introduction to IAM
• Advanced Roles and Groups Management Using IAM
• Introduction to S3

Updates

May 9th, 2024 - Resolved an issue causing validation checks to fail

September 15th, 2023 - Resolved an issue causing the build account S3 bucket to not provision