AWS Assume IAM Role - Step by Step tutorial (Part-3)

[@garimamehra3133]

Really liked the way you have explained the topic with hands-on and very crisp description .Thank you

[@ChadDiaz-qk4fb]

This was a great tutorial. I now understand how to assume roles better. Thank you

[@RahulWagh]

You're very welcome!

[@dineshrajnkl]

Great work Rahul! Assume Role: Allow entities in other AWS accounts belonging to you or a 3rd party to perform actions in the this account. Best practice when a third party will assume this role.

[@RahulWagh]

Glad it was helpful

[@RajashekarReddydasari]

What is the difference? Normally you would attach policies in the iam user and now you are saying assumerole. How is this beneficial? People keep saying temporary credentials but no proper example. Take a usecase like onprem Jenkins deploying code to ec2 instance or webapi calling lambda.

[@AdarshKumar-dk6sk]

Role is for the service and policy is for the user

[@comosaycomosah]

​@@rahulsingh-iq4gdappreciate a real answer dude!

[@anild-fh4tb]

Thank you Rahul! Great content! It really helped me a lot, I have gone through your Terraform videos also. I wish you good luck and keep educating us.

[@RahulWagh]

Glad it helped

[@xavAk]

Excellent tutorial. Thanks for the detailed explanation. However, we can add that it's not just users who can assume on a role, we also have aws services, applications etc.

[@RahulWagh]

It’s 100% true not only users other can also assume the roles

[@nsquare_4]

this is best explanation to create assume roles

[@mihirsuratwala9563]

Thanks for such nice video, also when we create a Iam role. In that we can edit the trust relationship and add multiple user's arn in list. Which will be more easy to give the assume role permission to multiple users at once.

[@SattiSatyavathi]

hi Rahul,these tutorials helped me a lot ,please make a dedicated video on control Tower as its trending right now and we also got a project to migrate the existing accounts to control tower,you video will help me a lot,thanks in advance

[@denzilpeiris492]

Excellent explanation, though I am a bit confused, rather might I say, trying to understand what would be the best case, real time scenario where STS: Assume Role can be implemented?

[@flaviaruffner1074]

Excellent. It answered a critical question fir me, around the type of role. I find the account definition to be a bit misdirecting.

[@ajitnklab]

Hey Rahul, For a small organization setup, no need to have 2 separate policies (resource policy & Trust Policy) We can give resource ARN (of who needs to assume this role) in the role trust relationship tab itself like below. Please share your comments.. In your video though & by default, Principal is AWS account. { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Principal": { "AWS": "arn:aws:iam::XXX:user/test-user" }, "Action": "sts:AssumeRole", "Condition": {} } ] }

[@dgillies5420]

Role is a container for a set of policies, and can be thought of as a phantom user. When you assumeRole, you become that phantom user to gain access to several different policies at once.

[@vlogswithtownboy]

perfect tutorial for assume role...thanks!!!

[@burhan_gif]

useful thanks this was a great tutorial for understand how to assume roles

[@RahulWagh]

You're very welcome!

[@ManojKumar-fb9zc]

its a tricky concept , but you explained it very easily . Appreciate your great work and good luck

[@RahulWagh]

Glad to know I hope you enjoyed

[@ManojKumar-fb9zc]

@@RahulWagh i further tried to imply the same concept to a user group , it worked like a charm , thanks again

[@RahulWagh]

@ManojKumar-fb9zc glad to know it worked for you😊. It is always focus on concept rather then easy fix

[@krishm5116]

Thanks. 1) Roles can have Policies but here Policy was referring Roles (role arn). 2) To achieve this need, user-id can be directly added S3-Full-Access policy also right?

[@ThePlayerum]

Nice explanation!

[@RahulWagh]

Glad it was helpful!

[@pupu86]

Very well explained. Thank you

[@RahulWagh]

You are welcome

[@muthukumarm7531]

Super Brother nice and calm explanation.

[@RahulWagh]

Glad to hear that

[@shivaprasadvadde6503]

Great explanation sir....make some videos on small projects sir... that was helpful for us...THANK YOU

[@RahulWagh]

Soon you will see

[@thapasujan07]

Thank you Sir. Please keep uploading these. ❣

[@RahulWagh]

Cheers

[@shradhasamantaray3062]

hello , do you have any videos explaining injectedidentity concept for provider configs

[@VeerendraGogineni]

Hi Rahul, Nice tutorial, How we can transfer data between Amazon S3 buckets using AWS Transfer Family

[@shadyapp7416]

I am aws solution architect professional certified, still refreshing my knowledge seeing ur videos😂

[@RahulWagh]

Glad to hear that

[@gerlynm50]

underrated content!

[@RahulWagh]

I am glad that you found it useful

[@PlutusKitchen]

You're the best 👍 💯 ♠

[@RahulWagh]

You are welcome

[@bantamalebronejames9588]

Rahul, please what is the difference between this and the Part 1 video. For me it looks the same, but this one is a long process

[@RahulWagh]

Part 1 is only focused on creating IAm role and user. But this part is more focused on how to assume the IAM role. Both the parts will look same in the beginning but there is big difference when you reach towards the end.

[@bantamalebronejames9588]

Alright, thank you@@RahulWagh

[@MonikaReddy-e4v]

Why to use that sign in link of the IAM role again after we created a inline-policy for the IAM user(test-user) where we have given the action to assume the IAM role(S3-Full-access-role). what's the significance of inline-policy then?

[@Adityabalaji-qv4nx]

VERY GOOD SIR

[@RahulWagh]

Keep watching

[@priyankapani9750]

Really nice content. Sir you have a soothing voice.

[@RahulWagh]

So nice of you

[@Learn_IT_with_Azizul]

Awesome.... was searching this content. Thank You

[@RahulWagh]

Glad it was helpful!

[@SuperSrikanth2012]

can we attache policy directly to IMA User without role

[@mangeshkhandale6435]

Content is good but the example given here is slightly confusing. In this example, you have created a user which inline policy calls the role. It is policy attached to the Role where the actual instructions are given to grant the access to the S3. Although this has worked but it is complex use. On the other hand the same can be achieved without uaing Role also. Here is how: Go to user & inline policy in it. In this policy you mark "Effect: Allow" , "Action:s3.*", "Resource:*" Thats it. Your user can now able to access the S3. No need to assume any Role or switch the URL etc.

[@mangeshkhandale6435]

Above is the example of inline policy. You can also attach the AWS managed policy. E.g. in the same example above, when click on add permissions select "Add permissions" instead of "Create inline policy" Select radio button "Attach policy directly". A list of policies appears. Select "AmazonS3FullAccess" from the list and save it. That's it. Your test user can now access the S3 services

[@RahulWagh]

@mangeshkhandale6435 I think you are confused i am not solving the problem on accessing the s3 bucket but instead how to access s3 bucket owned by the other account via assume role. Otherwise why would aws have the concept of assume role

[@mangeshkhandale6435]

Yes. I got it. What I was trying to say is , technically both approaches work. I'm not able to understand what is the benifit of assuming roles by IAM user. In the example you given I don't see any benifit. But definitely there must be some use cases. I'm not a pro in AWS. But I can see from vedios you have good knowledge here. May be you can create a vedio on use case where IAM user assume role instead of permissions from inline policies.

[@mixupthings]

how to use this role using sdk in java?

[@aishwarya-i6q]

Sir, What is the difference between root user and management account?

[@nehakamath8321]

Thank you for the tutorial ! :)

[@RahulWagh]

You're welcome 😊

[@ritupradhan6922]

Why we need aws role if we already have IAM policies.... root account can attache s3 policy for test user or if the test user is the root user than it have already all access....

[@RahulWagh]

Yes you are right but here I am trying to explain the assume by simulating the root user, test user and IAM roles otherwise how would explain the assume role scenario. I could easily solve the whole scenario by assigning correct IAM role to test user but that is not the case

[@ventin75]

It will be great if you can add in how to perform these in the CLI.

[@RahulWagh]

But why do not you use the Terraform so that you have infrastructure as a code

[@ventin75]

@@RahulWagh All the infra is already provisioned except the instance. So I just need a simple CLI command to run the instance.

[@A.Sandeep-18]

Sir a doubt, that means roles can be assumed for a single time or upto a time limit but policies will be permanent? Is my understanding right ?

[@RahulWagh]

Roles can be assumed when ever we need there is no time limit

[@A.Sandeep-18]

@@RahulWagh sir then if we are creating policies and using them directly to our users and services why there is a need of roles ? Please differentiate and help me understand

[@testK21]

You are the best.

[@RahulWagh]

Thanks for stopping by on my channel keep following for more similar content

[@pedrocarbon]

I was invited to entry a organization company in AWS, create my account, accept the invitation. But when i log in i dont see any service of the organization, just of my own account. How can i switch to see the services of the company?

[@shivaprasadvadde6503]

I think still you don't have any permissions to access

[@isaacambi1914]

I hope you have something on cloudformation

[@RahulWagh]

It is in my pipeline you would see those coming soon in upcoming weeks

[@srisouryakalivarapu]

I ain't able to switch accounts in the test account.. "Invalid information in one or more fields Check your information or contact your administrator." This is what it threw..can you help me out?

[@RajeeshCr2006]

Try this policy at Roles trust relationship tab instead of giving policy at user end { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Principal": { "AWS": "arn:aws:iam::XXX:user/test-user" }, "Action": "sts:AssumeRole", "Condition": {} } ] }

[@srisouryakalivarapu]

@@RajeeshCr2006 Thankyou

[@kjbiliks]

very informative

[@RahulWagh]

You are welcome

[@hashilbh5654]

This is awesome 🎉

[@RahulWagh]

Glad it helped

[@anilrout9388]

nice once can you create s3 cross region with 2 account

[@RahulWagh]

I will try

[@kiransonawane2940]

Really Awesome... :)

[@purnimashanti26]

Thank you.

[@RahulWagh]

You're welcome!

[@srgrmohan]

Thanks

[@RahulWagh]

Welcome

[@Derivscalpingsignals]

😢help here, root user can't create user because no identity based policy

[@Lakshmanan-og2ws]

could you please put Video to deploy databricks14 day free trail in AWS , it will be more useful to me and also Subscribers , Thank you.

[@RahulWagh]

We will try

[@bikdigdaddy]

amazing. thank you so much :)

[@RahulWagh]

You are welcome