How to configure AWS role on on-premise server?

user_6077803 0
Viewed 3720

I have created an AWS role and attached a policy to put objects in a S3 bucket.

I have a local Python application which is using the role. My personal AWS user has the permission to assume a role. Here is some code I use:

assumed_role_object = sts_client.assume_role(
    RoleArn="arn:aws:iam::account-id:role/test-role",
    RoleSessionName="myRoleSession"
)

This is working all fine but now my question is how I have to configure this on my on-premise server where I don't configure my personal user to assume the role.

I was thinking about creating an IAM user which has only the assumeRole permission and use this user to assume a role for my application.

I use a test-role-trust-policy.json

{
    "Version": "2012-10-17",
    "Statement": {
        "Effect": "Allow",
        "Principal": { "AWS": "arn:aws:iam::123456789012:root" },
        "Action": "sts:AssumeRole"
    }
}

and create the role with this:

aws iam create-role --role-name test-role --assume-role-policy-document file://test-role-trust-policy.json

Attach the necessary policies to my role (to put the S3 objects) and use the role in my application.

Is this the correct approach to configure a role for an on-premise server? I find it strange to create a user to use a role on my on-premise server (although the permission of the user is now restricted).

It's also not very clear for me if I have to use the root as principal or my user?

roles amazon-web-services
1 Answers

I don’t think there is anything wrong with your approach to create a special user for this use case. It can be a user without console login and only the rights to assume the given role.

Another approach would be to use a lambda to create pre-signed URLs. Using these URL’s your app would be able to put objects in that bucket without the need of an AIM role at all. The URL would only work for the time you want. Also you could design the URL to only allow a specific file name and other options.

If you would run it on another AWS resource such as an EC2 instance you could also give this instance the role directly.

user_37683650
Related