How to narrow down scope of AWS Kinesis cross account role

user_8866279 0
Viewed 39

So we create AWS kinesis in account A and create the role with only putRecord permission and then we give the role to account B where their lambda assumes the role and accordingly sends the data in.

But the problem here is the trust policy which is having root access and anyone in account B can assume the role and start pushing data

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": {
        "AWS": "arn:aws:iam::ACCOUNT2:root"
      },
      "Action": "sts:AssumeRole",
      "Condition": {}
    }
  ]
}

Can we reduce the scope to Account B particular service (lambda function) and no other should service should push data?

amazon-iam amazon-web-services
1 Answers

anyone in account B can assume the role

No, that's does not work that way. Any IAM entity (user, role) in account B which wants to access that role, still needs explicit IAM permissions to do so.

If you want only the lambda to assume the role, you have to use lambda executone role:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": {
        "AWS": "<arn-of-lambda-exec-role-from-acc-B-to-assume-the-role"
      },
      "Action": "sts:AssumeRole",
      "Condition": {}
    }
  ]
}
user_2488230
Related