Federated User Access to an S3 Bucket Across Multiple AWS Accounts
In AWS, it is common to have multiple accounts for different environments or teams. In such cases, granting access to resources like an S3 bucket to users from another account is a common requirement. This article explains how to set up Federated User Access to an S3 bucket across multiple AWS accounts using IAM Identity Center.
What is Federated User Access?
Federated user access is a method of authentication that allows users to access AWS resources using their existing corporate credentials, eliminating the need for managing separate AWS user accounts. This is achieved using Security Assertion Markup Language (SAML) 2.0-based identity providers (IdP) such as Okta, Azure AD, or IAM Identity Center.
Prerequisites
- Two AWS accounts: one for the S3 bucket and another for user management.
- An S3 bucket in the source account.
- IAM Identity Center set up in the user management account.
Steps to Configure Federated User Access
-
Create a SAML provider in the source account: In the source account, navigate to the IAM console and create a new SAML provider. Upload the SAML metadata file provided by your IdP (e.g., Okta, Azure AD, or IAM Identity Center).
-
Create a role for federated users: In the source account, create a new IAM role that allows access to the S3 bucket. Attach the necessary S3 permissions policy to this role. For federated user access, specify the SAML provider created in step 1 as the trusted entity.
-
Configure IAM Identity Center: In the user management account, navigate to the IAM Identity Center console. Create a new application and specify the SAML metadata of the SAML provider created in step 1. This will enable IAM Identity Center to act as the IdP for the source account.
-
Assign users to the application: In IAM Identity Center, assign users or groups to the application created in step 3. This will grant them access to the S3 bucket in the source account.
Code Example: S3 Bucket Policy
The following is an example of an S3 bucket policy that allows federated user access:
{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Principal": {
"Federated": "arn:aws:iam::<USER_MANAGEMENT_ACCOUNT_ID>:saml-provider/<SAML_PROVIDER_NAME>"
},
"Action": "s3:*",
"Resource": "arn:aws:s3:::<S3_BUCKET_NAME>/*"
}
]
}
Federated user access is a powerful feature in AWS that allows users to access resources using their existing corporate credentials. By following the steps outlined in this article, you can grant access to an S3 bucket in one account to users in another account using IAM Identity Center. This approach simplifies user management and enhances security by eliminating the need for managing separate AWS user accounts.