AWS - Cross Account access using

[@iammrchetan]

Thank you for this video! I remember while I was going through the interview, this kinda of question was asked. I wasn't sure at that time and had to ask many people working on AWS how to do that. This video cleared my doubts, learnt something today. Thanks a lot, Sir! Keep doing good for us.

[@knowledgeindia]

Sure. Please share and support us

[@abc-cf3sy]

so now , you are working on aws cloud?

[@muddulurumadhu5474]

This cross account access is very useful especially for working people. You explained it very clearly with out any confusion.

[@tamaralefcourt9213]

This tutorial/demo is amazing! It clearly explains how to set up cross account roles/access. It is much much better than official AWS documentation. Thank you!!!

[@pankajdube2262]

Amazing, wonderful, concept-clearing video.

[@pradiplamsal1403]

This is very clearly explained. Thanks to you.

[@srb1855]

Another fine video tutorial. Thank you for demonstrating this feature - it is finally clear to me.

[@pascaltube8434]

Hello, Last week I went through the another AWS course. I understood the concept. But on my own I could not do it, because in that training he is using cloud formation template and role is created automatically. This first time I realize how to create STS:Assume role and restrict it to the specific individual. Now if I go back the training course, I can join the dots backwards. Thanks a lot for this. The best point in this video is when went ahead without creating STS Assume role and made viewers to think. I look forward to your "Online" Handson training. The last impression of this video was "use of real world use cases" because you normally get these situation in day to day life.

[@knowledgeindia]

Sure. Do visit knowledgeindia.in to know the details and calendar

[@knowledgeindia]

There is a hands on training starting now. Visit knowledgeindia.in and register if you want

[@ramanathreya]

Amazing clarity of thought and flow of explanation. Kudos to the creators!

[@kazsid2995]

Excellent explanation and demo. I was struggling to understand switch role concept. Now its very clear. Thank you so much Sir

[@knowledgeindia]

Thanks for your appreciation. You can support our initiative of Free Practical Cloud Tutorials by sharing this video with your friends on Social channels, whatsapp etc. If it helped you solve a problem and you would like to applaud us, click the Applaud button :) For regular 1-1 interaction with me, check our Membership - kzbin.info/door/zpHRBVnkzBfSsXostYuW1gjoin ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

[@mufeezahmedmohammad9441]

very well explained ,lot of clarity

[@knowledgeindia]

Glad it helped! I am sure you will like our recently released KMS MasterClass video as well, check it here - kzbin.info/www/bejne/bpLMnYmki7Wcnc0

[@somnath_das]

Hats off to you for such amazing content. You know where a user can be stuck and emphasize on this portion. Superb

[@knowledgeindia]

Thank you. You can support this initiative by sharing our videos. 👍👍

[@ambikaprasad9464]

Very nice explanation with use case.

[@kiraneshwargoli7816]

Superb scenario based video...kudos to KI..

[@knowledgeindia]

Thanks a ton. Please do share with your friends..

[@suraskumarnayak8350]

Awesome video. This deserves like a hundred thumbs up from me.

[@knowledgeindia]

You can share the video on LinkedIn and help us

[@vedanti-vidhan4766]

what a tutorial !! Amazing, simply Amazing !! I Applauded :)

[@knowledgeindia]

Thank you very much!

[@ashokjeevan]

The use cases you present is great! Thank you :)

[@knowledgeindia]

Please subscribe to get all the future updates

[@rajeevkumarsinha]

well demonstrated, enjoyed this video. thanks a lot.

[@ManishKumar-dl2ux]

an awesome explanation for cross-account access

[@knowledgeindia]

Thanks Manish. SUBSCRIBE to KZbin channel: kzbin.info Watch our videos in correct order: bit.ly/2GVzLti Connect on LinkedIn, receive AWS updates & Practical Scenario Questions - bit.ly/2XC5bZg If you have got benefited, you can support us on PATREON: bit.ly/2TzxTbb Join AWS Practical Learning Group on LinkedIn: bit.ly/2Vx7aOi SUBSCRIBE to our blog for AWS exercises & case-studies: www.knowledgeindia.in/

[@tejumokshasasapu7629]

thank you very much sir....understood it very well 😊😊

[@meenu2511]

Very well explained, simple thing explained in an even simpler manner.

[@knowledgeindia]

Don't stop at this .. Do watch more complex topics on our channel..

[@indranilgoswami1500]

Thanks a lot sir.. You clear my doubt.. Excellent

[@knowledgeindia]

Thanks. You can support us by sharing the video

[@bro_prakash]

Thank you for sharing this information 🎉

[@knowledgeindia]

Glad it helped! I am sure you will like our recently released KMS MasterClass video as well, check it here - kzbin.info/www/bejne/bpLMnYmki7Wcnc0

[@smartway4201]

A GOOD AND AMAZING CONTENT, THNKS FOR IT

[@ravindraprasad1309]

Its one of the best video

[@knowledgeindia]

Thanks Ravindra :) Please share with your friends as well and help us.

[@sachidanandshahane5709]

Sir you to Good explanation each and every content of this video also and other videos which I seen nice to explain basic and deep learning thanks for sharing

[@knowledgeindia]

Thanks a lot.. Please LIKE & SHARE to support us...

[@arnold5621]

Great work

[@souravjoshi7149]

Thanks 🙏👍 a lot. For you I got my KZbin channel back.

[@narutokunn]

Superb. Thankss

[@shahul3203]

Fantastic

[@muhammadnaziralam3830]

Thank you so much Sir..

[@anupbit6]

Very well explained ..

[@knowledgeindia]

Please do share with your friends .. Thank you...

[@Niruukumar]

Nice explanation.. Well 👍

[@micheldesmet5501]

Great video, thanks a lot!

[@egemenulus7694]

awesome tutorial sir! thanks a lot!

[@time_traveller_kl2946]

Nice explanation... subscribed

[@jksharma7]

Very Good

[@prannoyroy5312]

wonderful work!

[@knowledgeindia]

Thank you! Cheers!

[@ManishYadav0719]

Thank God....I found AWS awesome channel .....I ma very new to AWS , Please let me How can I crack AWS associate Architecture exam???....I started watching Videos from your channel...and It just awesome Sir....

[@knowledgeindia]

follow the playlist and do practicals as well.

[@balasekharnelli9218]

Well explained!

[@knowledgeindia]

Thanks! Please share our video and support us to do more..

[@bosneo1]

Great video

[@knowledgeindia]

Please check out our playlists for more AWS practical videos

[@veerusharma1525]

Awesome explanation ☺️

[@knowledgeindia]

Thanks Veeru :) Please share with your friends on Linkedin / FB

[@sardarahmed5174]

"One of the best AWS Tutorials on the net....", kudos KI. One request -> Can you please do a session on IAM permission boundaries..

[@knowledgeindia]

Sure will do it soon. Keep sharing and supporting us

[@thanojp3964]

Good explanation

[@knowledgeindia]

Thank you. Please do check out other videos on our channel as well for the same type of content..

[@GAURAVAREGE]

Best one

[@bhakta_rg]

Nice one. thanks KI!

[@knowledgeindia]

keep supporting us, by sharing our videos..

[@tejakirankumarjami9993]

you are the best :) waiting for IAM policies session

[@knowledgeindia]

Thanks Kiran.. Please extend your support by sharing our videos with your friends.

[@tejakirankumarjami9993]

@@knowledgeindia sure thing and I'm already sharing your videos to my friends

[@mallubiradar2367]

Thanks for the good explanation, once this set up is done. how to achieve cross-account sign in using AWS CLI

[@ubedullasyed7363]

Thanks and very nice video :)

[@knowledgeindia]

Please SHARE and support us.. :)

[@Tapaseamol]

Thanks! for the video , Just got a thought , I was wondering if the same thing could be done between two AWS organizations?

[@knowledgeindia]

If you are specifying account ID in "trust relationship" policy, then the accounts could actually belong to 2 different AWS orgs. Glad this video helped! I am sure you will like our recently released KMS MasterClass video as well, check it here - kzbin.info/www/bejne/bpLMnYmki7Wcnc0

[@chetanhireholi]

Thank you!

[@knowledgeindia]

You're welcome! please share it with your friends and help them as well.

[@ravi2int]

Great video!! you just earned another subscriber. quick question though. now that you have created user grp and attached inline 'assumerole' policy, we don't have to modify trust relationship to explicitly deny komal's permission? assuming komal is not the part of that user grp.

[@vijaykumar-yq7sf]

Great

[@knowledgeindia]

Thanks Vijay.

[@gratecircle]

nice video. i follow all you videos. my sincere request, please do not add music.

[@HambaAllah-xn2zp]

Greatttttt!!!!!

[@chandrakanth899]

Thank you sir. This is very helpful. I have a question beyond this part. Say I have 2 users user1 and user2, part of "assumeRoleGroup", on KI2 and i want all users part of "assumeRoleGroup" to be able to assume role on KI3 and no one else. How do I do that? I tried adding the arn of the group to Trust relationships on KI3 but that failed - gave me an error. Looking forward for you suggestion

[@knowledgeindia]

You cannot identify a user group as a principal in a policy (such as a resource-based policy) because groups relate to permissions, not authentication, and principals are authenticated IAM entities.

[@shubhamagarwal1029]

very well explained...can you do a session where showing multiple issues regarding this switch role on real scenario based and how to tackle that...!!

[@dileepkomatineni7694]

Thanks for the video. I have a question, Instead of creating a group and adding users in 2nd account, Can we add Gopal and Komal as trusted users while giving permissions in Another AWS account option(role permissions) window?

[@praneeth0820]

That was detailed ! One quick question regarding STS. Since assume role is under STS, in this use case once the user gopal assumes role in KI3 what would be the credentials used ? i mean will temporary credentials with a token be generated and used ?

[@knowledgeindia]

Yes

[@pgurramap]

Nice video. This video covers read-only access to KI3 How do provide Admin access to KI3 only for particular user who is on KI2?

[@knowledgeindia]

Create an IAM role and add administrator policy to that user. Set us trust relationship correctly.. Watch the video once again to get it clearly.

[@venkat330]

Thanks for providing such a clear content free, I am trying to understand what fits my use-case, lets say I have a binary which I need to run in another EC2 - VPC-peering / VPN / ?? .

[@wilmaldo]

The tutorial was great. I was able to successfully delegate the role, but having problems creating a separation between environments (prod and demo). I have tried to add resourcetag to both IAM roles and STS and neither or working. I want a user with AdminAccess to have that access but limit him or her to demo or prod. Can you please provide some guidance on this topic? Thank you for the videos.

[@knowledgeindia]

Hi, Congrats on becoming our member. I will help you on this. Could you please elaborate this more on an email to me? Or, if you want we can take this up in our interaction for this month. We can setup some suitable time and help you over ZOOM/Live meeting.

[@ricx4u]

apart from role policy being restricted to Gopal, is it not true that Komal is not able to to log in "also" because she has not been given switch role permissions via STS role's API.

[@NitinKumar-vd1sn]

exactly my question!

[@devangsanghani6765]

Wonderfully explained the 'oops' and 'gotchas' here. Watched it twice to understand it fully well. I see why the account granting access would want to restrict only to the legitimate users(Gopal). But going by principle of least privilege, Komal should not be given the STS access altogether if there really is going to be no need for her. Was it necessary?

[@knowledgeindia]

Devang, that's more for the demo. Also, it is possible that Komal is allowed to assume role in some other AWS account. But, she should have Assume Role as the first step, isn't it?

[@devangsanghani6765]

@@knowledgeindia : Right. So, we have the classic answer here "It depends" :).

[@DevOpsHawk]

precisely explained, well done my friend. Keep it up the good work....👍 one query: If any object is uploaded to S3 bucket named KI3 of KI3 account by user Gopal of KI2 account; will a user name Ram in KI3 account, be able to download the same object ffrom KI3 bucket of KI3 account (assuming appropriated policy is attached to IAM user Ram with download policy)?

[@knowledgeindia]

Yes he would be

[@knowledgeindia]

Please share our videos with friends

[@venki090790]

can you please explain what is STS in detail and in which cases we have to use STS policy

[@DailyLearnings1]

I'm explaining below what I understood Please correct me if my understanding is wrong here Let's say users in acc b wants to access resources in acc a Step1- acc a needs to have a role that should be allowing acc b users (arn) Step 2 - acc b needs to have the users mapping arn in above step besides this policy with service sts and permission assume role should be assigned to users. Verification - acc b user login, then switch role, he need to know acc a details which are acc number of acc a and also the role name he created

[@knowledgeindia]

Perfect.. But, i suggest that you also do it and be confident :)

[@knowledgeindia]

Share with your friends on Linkedin / FB.

[@srinathvk]

Very nice tutorial. Just one question. How do I add multiple users (i.e. >1) in Trust relationship?

[@knowledgeindia]

as you add multiple values in an array - separated by comma. give their full ARNs separated by comma. Please Like & Share with your friends.

[@srinathvk]

@@knowledgeindia Sure. Appreciated.

[@DrRadtke]

Nice explanatory video, thanks. But the background music is unnecessary and very disturbing while you try to focus on the content.

[@knowledgeindia]

Thank you. Will take care of it in the future. Check our playlists for more :)

[@AB-mr1fy]

Sir why was user Gopal assigned read only permissions only in KI2 account. I mean if Gopal had been assigned full access in KI2, would that have made a difference considering that the role assumed already is customised to be read only accessible.

[@DailyLearnings1]

Also I have a doubt in 10:01 i see that there is api session as 1 hour what is that option, what it does??

[@knowledgeindia]

that's the duration for which the temporary credentials would be valid for this IAM role (after assumption of the role).

[@DailyLearnings1]

@@knowledgeindia so what after that duration??

[@knowledgeindia]

either assume again OR this attribute could be increased to higher value as well, but cannot be indefinite. Try it out by doing it practically.

[@DailyLearnings1]

@@knowledgeindia reassuming is heptic, yes I gave role to someone with 8hrs session but I will meet him tomorrow and will check if he's still able to access my resources. Don't want to spoil someone's weekend hahaha

[@DailyLearnings1]

FYI for programmatic access behavior is not so, you'll create the arn entry in config files to assume, it keeps on extending the session. This was told to me didn't check it in lab

[@sekharchowdary6326]

Hello ki please upload deep dive of redshift service

[@jerrysabbagh1499]

Is there a way when you create the role on KI3 to use the ARN for a particular user?

[@knowledgeindia]

Yes. Specify that user's Arn in the trust relationship.

[@knowledgeindia]

Watch our complete security playlist for more

[@jerrysabbagh1499]

@@knowledgeindia That seemed like a second step.

[@livelifenjoy]

I have a quick question , if i have server side encryption enabled at the bucket and i do give another cross account role permission to put data in bucket , but the cross account owner insists on client side encryption , i understand this can be done by sharing KMS key and they can use any SDK at their end to achieve it . a) Is it is possible to achieve this? b) When Retrieving the object out of the bucket then we would need to use the same KMS key to decrypt the object after downloading the object from bucket ? Regards Rahul

[@knowledgeindia]

Rahul, I think you are mixing server and client side encryption. Normally, you would choose to implement one out of two. Please read - docs.aws.amazon.com/AmazonS3/latest/dev/UsingClientSideEncryption.html

[@knowledgeindia]

If you choose server side encryption, you don't need to do anything to encrypt and decrypt. Just that permission should be there to use Kms by the respective accounts

[@livelifenjoy]

@@knowledgeindia but if they are doing client side encryption then the object that is going to be uploaded is an encrypted one isn't it ?? In that case don't we need to decrypt it if we need to do something with that object

[@livelifenjoy]

Also is it not possible to do client side encryption if we have server side encryption enabled on s3 bucket ??

[@knowledgeindia]

Yes you will have to decrypt in case when client side encryption used. If you want you can do both, but normally one is done at a time.

[@nadeem5836]

How to configure same thing using AWS CLI...?

[@akhashr]

Great. Very helpful. But the background music is very distracting

[@paragrane7798]

Thanks for wonderful series Regarding cross account access How to give group of users cross account access in trusting account I can not add group in trusted entity because it is not principal can you suggest

[@knowledgeindia]

we will have to use IAM roles

[@rvani69]

All is Good but Why music Background

[@knowledgeindia]

I made a mistake. Won't repeat it 🙀

[@vineetanand5341]

Please share Playlist for AWS videos.

[@knowledgeindia]

you can visit the playlist section on our channel.

[@gunjanchandani8004]

I have an java app running in EC2 instance which makes use of aurora rds in another account as its data base ...can we implement this scenario using this ?

[@knowledgeindia]

if you are using DB level user & password, then peer the VPCs and then it will work. IAM does not have a role there.

[@AB-mr1fy]

Sir why did user Gopal have to sts assume role?

[@sumanbk92]

How can i do the same thing through CLI or API ?

[@funvideo1400]

I have below requirnment: I want to see all child account cloudwatch alarms on parent account and from that account i am going to integrate it with my MOM layer... How can i see all account alert in my parent account Secondly, I want to trigger SNS topic which is available in my parent account and i want to trigger it from my child account..

[@SandeepVerma-gn3lw]

Hello Sir......Let's suppose we have 100 users in my AWS account and I want only 90 users to be able to access the other account.....then do we have to edit the trust relationship for each of them, or there is any other way to do it in one shot.......Thanks in advance

[@hasanaltinkaynak30]

@@knowledgeindia i tried but it doesnt allow me. Could you help to allow to only for one group?

[@hasanaltinkaynak30]

@@knowledgeindia An error occurred: Invalid principal in policy: "AWS":"arn:aws:iam::**************:group/ReadOnlyAccess"

[@knowledgeindia]

Looks like group can not be specified

[@hasanaltinkaynak30]

​@@knowledgeindia what is the limit of the user on a role?

[@randomreddy2701]

how to do this terraform ?

[@rehantayyab82]

why did you assign read only access to gopal in ki2 ( does it has any thing to view objects in ki3 ........ i think no ) ........... this is bit confusing .........hope i try to explained my question clearly

[@knowledgeindia]

Good question. Try to test it first without allocating it. You will be clear then.

[@creation1989]

I have multiple vpc in one account and one user I have to give access of only specific vpc and not other vpc and other resources is it possible

[@knowledgeindia]

Use conditions in IAM policy

[@vivekreddychagam5459]

what about cli access

[@knowledgeindia]

You can do STS: assumerole

[@shovas6042]

This video is really helpful.Thank you so much.Kindly guide how to crack ACSAA-2019

[@knowledgeindia]

thanks. please watch our playlists and read scenarios / questions in our blog. Join on Linkedin Group.

[@shivanandmadival8556]

Can you please stop the background music... going fwd?

[@knowledgeindia]

Yes done that already. Please check latest videos on our channel ✌️✌️

[@ChristophShyper]

I don't believe you should create IAM users for every employee. And also copying the same IAM roles between hundreds of accounts is just a waste of time.

[@NoNo1913]

What would you recommend? 🤔

[@ChristophShyper]

@@NoNo1913 Use SSO solution. E.g. AWS SSO, Okta, Auth0, or any other. That's industry standard for years now.

[@master2466]

Background Music is annoying.

[@staj]

Brilliantly Done thanks a lottt for this video. Have a Great New Decade.

[@knowledgeindia]

Thank you. Please do share..

[@baisong778]

Great video