11.4 Cross Accounts Access

What is Cross Account Access

Many AWS customers use separate AWS accounts for their development and production resources. This separation allows them to cleanly separate different types of resources and also provide some security benefits.

Cross account access makes it easier for you to work productively within a multi-account (or multi-role) AWS environment by makeing it easy for you to switch roles within the AWS management console. You can now sign in to the console using your IAM user name then switch the console to manage another account without having to enter (or remember) another user name and password.

Steps (you need two AWS accounts):

Identify our account numbers. Login to our account
Create a Group in IAM - Dev, called Developer, add AdministratorAccess policy.
Create a User in IAM - Dev, called John, has AWS Management Console access, add John into Developer group. Remember the sign-in address because the user has AWS Management Console access.
Login to Production Account
Create a new S3 bucket and create a "read-write-app-bucket" policy (don't forget to modify the ARN of the shared bucket in the policy)
Create a "UpdateApp" cross account role
Create a "MyDevelopersAccess" cross account role (you need to provide the Account ID of Developer Account to Production Account).
Apply the newly created policy to the role. (Attach the "read-write-app-bucket" policy to this role)
Login to the Developer Account
Go to Groups -> Permissions. Create a new inline policy called "allow-assume-s3-role-in-production". (Don't forget to modify the Production-Account-ID, i.e. provide the Account ID of Production Account to Developer Account)
Apply this inline policy to the Developer group
Logout and then Login as John using the sign-in address of John that you remembered in a previous step, because he has AWS Management Console access. When John login, the console will show John@[account-number]
Click Switch Role to switch from Developer Account to Production Account using Account Number and "MyDevelopersAccess" Role.
When you switched the account, you can see the shared S3 bucket and then you can manipulate this bucket.

You don't need to remember all the steps in the exam. Find the resources in this lab on Udemy.

Previous11.3 AWS Organizations - Lab Next11.5 Resource Groups & Tagging

Last updated 5 years ago

Was this helpful?

What is Cross Account Access

Steps (you need two AWS accounts):

Identify our account numbers. Login to our account

Create a Group in IAM - Dev, called Developer, add AdministratorAccess policy.

Create a User in IAM - Dev, called John, has AWS Management Console access, add John into Developer group. Remember the sign-in address because the user has AWS Management Console access.

Create a new S3 bucket and create a "read-write-app-bucket" policy (don't forget to modify the ARN of the shared bucket in the policy)

Create a "UpdateApp" cross account role

Create a "MyDevelopersAccess" cross account role (you need to provide the Account ID of Developer Account to Production Account).

Apply the newly created policy to the role. (Attach the "read-write-app-bucket" policy to this role)

Go to Groups -> Permissions. Create a new inline policy called "allow-assume-s3-role-in-production". (Don't forget to modify the Production-Account-ID, i.e. provide the Account ID of Production Account to Developer Account)

Apply this inline policy to the Developer group

Logout and then Login as John using the sign-in address of John that you remembered in a previous step, because he has AWS Management Console access. When John login, the console will show John@[account-number]

Click Switch Role to switch from Developer Account to Production Account using Account Number and "MyDevelopersAccess" Role.

When you switched the account, you can see the shared S3 bucket and then you can manipulate this bucket.

You don't need to remember all the steps in the exam. Find the resources in this lab on Udemy.