AWS S3 cross account access with EC2 and IAM role profile | Fine grained control with Bucket Policy

[@beyondthecloud]

Please provide your valuable feedback in the comment section. Please like share and subscribe for more upcoming content.

[@lomalomaloma123]

Nice content

[@beyondthecloud]

Thanks

[@vaibhavjain1in]

Hi, does profile name should be same as role or anything like that? I am following your tutorial but when I try to verify after creating profile, it days the config profile couldn't find.

[@beyondthecloud]

I dont understand your question. Which profile name you are referring to? I guess you did not do the trust relationship properly. Thanks for your comment

[@ammarkhalid2872]

I have account A that has ec2 and in account B i have s3 and amazon connect. From ec2 i can access the s3 bucket but when i do pause and resume recording it says donot have access for amazon connect. But s3 cross account is working

[@beyondthecloud]

It seems like you are facing an issue with cross-account access permissions between Amazon EC2 and Amazon Connect, despite having set up cross-account access to an S3 bucket successfully. Here's a step-by-step approach to troubleshoot and potentially resolve the issue: Check IAM Policies for Amazon Connect: Ensure that the IAM role attached to the EC2 instance in Account A has the necessary permissions to access Amazon Connect in Account B. The permissions for S3 and Amazon Connect are separate, and having access to one does not guarantee access to the other. Verify Trust Relationships: For cross-account access, the IAM role in Account A must have a trust relationship that allows it to assume a role in Account B that has the necessary permissions for Amazon Connect. Review Amazon Connect Access Policies: In Account B, check the policies attached to the role that Account A's EC2 instance is assuming. Ensure that the policies include actions such as connect:PauseRecording and connect:ResumeRecording. Inspect Resource-Based Policies: If Amazon Connect uses resource-based policies (like S3 bucket policies), verify that these policies allow the necessary actions from the EC2 instance in Account A. Examine the AssumeRole Operation: When the EC2 instance in Account A tries to access Amazon Connect in Account B, it must perform the sts:AssumeRole operation successfully. Check CloudTrail logs in both accounts to confirm that this operation is not failing. Check Service Control Policies (SCPs): If Account B is part of an AWS Organizations setup, ensure that Service Control Policies (SCPs) are not blocking access to Amazon Connect. Review Network Configuration: While network configuration is less likely to be the issue if S3 access is working, it's still worth confirming that the EC2 instance has the necessary network access to reach Amazon Connect endpoints. Look for Conditional Statements: Sometimes, policies contain conditional statements that restrict access based on certain conditions. Make sure there are no conditions that are inadvertently preventing access to Amazon Connect. Check for Explicit Deny: An explicit deny in any policy will override any allow statements. Ensure there are no explicit deny statements in the policies that could be affecting access to Amazon Connect. Test with AWS Policy Simulator: Use the AWS Policy Simulator to test the policies attached to the IAM role to ensure they provide the expected permissions to access Amazon Connect. Here's a sample policy snippet that you might need to include in the IAM role policy in Account B to allow Account A's EC2 instance to pause and resume recordings in Amazon Connect: { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "connect:PauseRecording", "connect:ResumeRecording" ], "Resource": "arn:aws:connect:region:account-id:instance/instance-id" } ] } Replace region, account-id, and instance-id with the appropriate values for their Amazon Connect instance. If you follow these steps and still faces issues, then you may need to provide more detailed information about the configuration for further troubleshooting.

[@ammarkhalid2872]

Thanks for the reply i will test

[@ammarkhalid2872]

Can you please tell that In /.aws/ config I have put ARN of of account B and created profile test When i access use command Aws s3 ls --profile test It gives me bucket list that is in account B But when i use without profile test it says access denied aws s3 ls Why is it happening that how i can do without profile test so it can access that