You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Is it possible to use those "temporary creds 1" to assume a role located on account2?
What I've tried is:
for i := 0; i <= len(account.Role); i++ {
if i == 0 {
result, _ = svc.AssumeRole(&sts.AssumeRoleInput{
RoleArn: &account.Role[i],
RoleSessionName: "test",
})
} else {
fmt.Println("assume role on account 2 with temporal credentials from account 1")
result, _ = svc.AssumeRole(&sts.AssumeRoleInput{
RoleArn: &account.Role[i],
RoleSessionName: "test",
})
}
}
Where account.Role is a slice such as [arn:aws:123:role1/role1 arn:aws:321:role2/role2]
Then the preceeding logic is as follows:
1- Assume starting role from account.Role slice, with the actual credentials from the account 1 (mentioned in picture)
2- Use the temporal sts credentials obtained from step 1 and call the assume role operation on account 2 with this creds.
It is faling with:
AccessDenied: User: arn:aws:iam::123:user/role1 is not authorized to perform: sts:AssumeRole on resource: arn:aws:iam::321:role2/role2
status code: 403, request id: e211a4a5-2cdd-456a-acb1-6877a0ab22d0
As you can see, it is not grabbing and using the temporal credentials generated on the step 1.
reacted with thumbs up emoji reacted with thumbs down emoji reacted with laugh emoji reacted with hooray emoji reacted with confused emoji reacted with heart emoji reacted with rocket emoji reacted with eyes emoji
-
Hey there, thanks for your amazing contribution to the open-source world.
Is there any function helper or implementation which enables to assume credentials from another account using some temporal sts credentials?
I am using:
(from: https://plainenglish.io/blog/aws-iam-role-chaining-df41b1101068)
Is it possible to use those "temporary creds 1" to assume a role located on account2?
What I've tried is:
Where
account.Role
is a slice such as[arn:aws:123:role1/role1 arn:aws:321:role2/role2]
Then the preceeding logic is as follows:
1- Assume starting role from account.Role slice, with the actual credentials from the account 1 (mentioned in picture)
2- Use the temporal sts credentials obtained from step 1 and call the assume role operation on account 2 with this creds.
It is faling with:
As you can see, it is not grabbing and using the temporal credentials generated on the step 1.
Is there any smart way of achieving this?
Beta Was this translation helpful? Give feedback.
All reactions