Crossaccount access to s3 from python application within a pod

Viewed 20

I looked for and read other similar topics but I couldn't find something that could help me.

I currently have a django application running into a pod on EKS from AWS account 1.

We have an AWS S3 resource located into another account (2).

I have roles for each accounts, with a role2 with permission for a role1 to assumeRole.

But, when I test several example codes microservices responds with erros like:

"ClientError ('An error occurred (AccessDenied) when calling the AssumeRole operation: user arn role1 is not authorized to perform sts:AssumeRole on resource arn role2)"

I don't have any AWS credentials (ACCESS KEY ID nor SECRET_ACCESS_KEY)

Please, i would like to understand how to implement S3 access in django application with crossaccount arn roles.

Thanks (code below)

client_account_1 = boto3.client("sts")
credentials_account_1 = client_account_1.assume_role(
        RoleArn=role1_arn
    )["Credentials"]

client_account_2 = boto3.client(
    "sts", 
    aws_access_key_id=credentials_account_1["AccessKeyId"],
    aws_secret_access_key=credentials_account_1["SecretAccessKey"]
)

credentials_account_2 = client_account_2.assume_role(RoleArn=role2_arn)["Credentials"]

account_2_s3_resource = boto3.resource(
    "s3",
    aws_access_key_id=credentials_account_2["AccessKeyId"],
    aws_secret_access_key=credentials_account_2["SecretAccessKey"],
    aws_session_token=credentials_account_2["SessionToken"]
)


0 Answers
Related