How to programmatically switch between IAM users when routing your app?

Viewed 86

Is it possible to implement such logic when you want different IAM users to handle various routes in your code?

Say you have set up three IAM users which have respective CRUD permissions:

iam_users = [
    app_reader,    // Read permission
    app_updater,   // Update permission
    app_deleter    // Delete permission
]

and your logic is sth like:

    if (read request is sent) { set AWS user to app_reader }
    else if (update request is sent) { set AWS user to app_updater }
    else if (delete request is sent) { set AWS user to app_deleter }
1 Answers

Such functionality would be best obtained using IAM roles, instead of different IAM users.

So in your code you would have to use sts assume-role to delegate read, update and delete operations to the corresponding IAM roles. This way, API calls to AWS would be executed using permissions of the roles.

Related