Assuming roles for temporary access in AWS - Mini Project: Build & Apply

Assuming Roles for Temporary Access in AWS

📖 Scenario: You are managing AWS resources and want to allow a user to temporarily access another AWS account's resources securely. This is done by assuming a role that grants temporary permissions.

🎯 Goal: Create an AWS IAM role trust policy and write the AWS CLI command to assume that role for temporary access.

📋 What You'll Learn

Create a trust policy JSON that allows a specific AWS account to assume the role

Define the role name as TemporaryAccessRole

Write the AWS CLI command to assume the role using the exact role ARN

Use the session name TempSession in the assume-role command

💡 Why This Matters

🌍 Real World

Temporary access by assuming roles is a common practice to securely delegate permissions across AWS accounts without sharing long-term credentials.

💼 Career

Understanding role assumption and trust policies is essential for AWS administrators, security engineers, and cloud architects to manage secure access and permissions.

1

Create the trust policy JSON

Create a variable called trust_policy and assign it a JSON string that allows the AWS account with ID 123456789012 to assume the role. The policy must have Version set to "2012-10-17" and a Statement with Effect set to "Allow", Principal with "AWS": "arn:aws:iam::123456789012:root", and Action set to "sts:AssumeRole".

AWS

# Your code here

Hint

Use a JSON string with the exact keys and values for the trust policy.

2

Define the role name

Create a variable called role_name and set it to the string "TemporaryAccessRole".

AWS

trust_policy = '{"Version": "2012-10-17", "Statement": [{"Effect": "Allow", "Principal": {"AWS": "arn:aws:iam::123456789012:root"}, "Action": "sts:AssumeRole"}]}'
# Your code here

Hint

Assign the exact string "TemporaryAccessRole" to the variable role_name.

3

Write the AWS CLI assume-role command

Create a variable called assume_role_command and assign it the AWS CLI command string to assume the role. Use the role ARN arn:aws:iam::123456789012:role/TemporaryAccessRole and the session name TempSession. The command should start with aws sts assume-role.

AWS

trust_policy = '{"Version": "2012-10-17", "Statement": [{"Effect": "Allow", "Principal": {"AWS": "arn:aws:iam::123456789012:root"}, "Action": "sts:AssumeRole"}]}'
role_name = "TemporaryAccessRole"
# Your code here

Hint

Use the exact role ARN and session name in the AWS CLI command string.

4

Complete the role creation command

Create a variable called create_role_command and assign it the AWS CLI command string to create the IAM role named TemporaryAccessRole with the trust policy stored in trust_policy. Use the command aws iam create-role with --role-name and --assume-role-policy-document options. Assume the trust policy is saved in a file called trust-policy.json.

AWS

trust_policy = '{"Version": "2012-10-17", "Statement": [{"Effect": "Allow", "Principal": {"AWS": "arn:aws:iam::123456789012:root"}, "Action": "sts:AssumeRole"}]}'
role_name = "TemporaryAccessRole"
assume_role_command = "aws sts assume-role --role-arn arn:aws:iam::123456789012:role/TemporaryAccessRole --role-session-name TempSession"
# Your code here

Hint

Use the exact AWS CLI syntax to create the role with the trust policy file.

Practice

1. What is the main benefit of assuming an AWS role for temporary access?

easy

A. It automatically deletes the AWS account after use.

B. It provides temporary, limited access without using permanent credentials.

C. It disables all access to AWS resources.

D. It creates a new permanent user with full permissions.

Solution

1. Step 1: Understand role assumption purpose

   Assuming a role grants temporary permissions without needing permanent credentials.

2. Step 2: Compare options

   Only 'It provides temporary, limited access without using permanent credentials.' correctly describes temporary, limited access. Others describe incorrect or unrelated actions.

3. Final Answer:

   It provides temporary, limited access without using permanent credentials. -> Option B

4. Quick Check:

   Temporary access = It provides temporary, limited access without using permanent credentials. [OK]

Hint: Temporary access means no permanent keys used [OK]

Common Mistakes:

• Thinking roles create permanent users
• Confusing role assumption with account deletion
• Believing role assumption disables access

2. Which AWS CLI command is used to assume a role for temporary access?

easy

A. aws sts assume-role

B. aws iam create-role

C. aws s3 ls

D. aws ec2 start-instances

Solution

1. Step 1: Identify the correct command for role assumption

   The AWS CLI command to assume a role is aws sts assume-role.

2. Step 2: Eliminate unrelated commands

   Commands like aws iam create-role create roles but do not assume them; others manage services unrelated to role assumption.

3. Final Answer:

   aws sts assume-role -> Option A

4. Quick Check:

   Assume role command = aws sts assume-role [OK]

Hint: Assume role uses 'sts' service in CLI [OK]

Common Mistakes:

• Using 'iam create-role' instead of 'sts assume-role'
• Confusing service commands like s3 or ec2
• Typing incorrect command syntax

3. What is the expected output when running this command?

aws sts assume-role --role-arn arn:aws:iam::123456789012:role/demo --role-session-name testSession

medium

A. A JSON with temporary security credentials including AccessKeyId, SecretAccessKey, and SessionToken.

B. An error saying 'role not found' because the ARN is invalid.

C. A list of all IAM users in the account.

D. A confirmation message that the role was created.

Solution

1. Step 1: Understand the command output

   The aws sts assume-role command returns temporary credentials in JSON format.

2. Step 2: Analyze options

   Only 'A JSON with temporary security credentials including AccessKeyId, SecretAccessKey, and SessionToken.' correctly describes the expected JSON output with temporary keys. Others describe errors or unrelated outputs.

3. Final Answer:

   A JSON with temporary security credentials including AccessKeyId, SecretAccessKey, and SessionToken. -> Option A

4. Quick Check:

   Assume-role output = temporary credentials JSON [OK]

Hint: Assume-role returns temporary keys in JSON [OK]

Common Mistakes:

• Expecting role creation confirmation instead of credentials
• Confusing assume-role output with user listing
• Assuming error without verifying ARN

4. You run aws sts assume-role but get an 'AccessDenied' error. What is the most likely cause?

medium

A. The AWS CLI is not installed on your machine.

B. The AWS account is suspended.

C. The role session name is missing from the command.

D. The IAM user or role does not have permission to assume the specified role.

Solution

1. Step 1: Understand 'AccessDenied' meaning

   This error means the caller lacks permission to perform the action.

2. Step 2: Identify permission requirements for assume-role

   The IAM user or role must have explicit permission to assume the target role.

3. Final Answer:

   The IAM user or role does not have permission to assume the specified role. -> Option D

4. Quick Check:

   AccessDenied = missing assume-role permission [OK]

Hint: AccessDenied usually means missing assume-role permission [OK]

Common Mistakes:

• Assuming CLI installation causes AccessDenied
• Ignoring required role session name
• Blaming account suspension without checking permissions

5. You want to allow an EC2 instance to assume a role temporarily to access S3 buckets. Which combination is correct?

hard

A. Manually run aws sts assume-role on the EC2 instance without any IAM role attached.

B. Create an IAM user with S3 permissions and store its permanent keys on the EC2 instance.

C. Attach an IAM role with S3 permissions to the EC2 instance and use the instance profile to assume the role automatically.

D. Attach a security group to the EC2 instance that allows S3 access.

Solution

1. Step 1: Understand EC2 role usage

   Attaching an IAM role to EC2 via instance profile allows automatic temporary credentials for S3 access.

2. Step 2: Evaluate other options

   Manually running aws sts assume-role without an attached IAM role fails due to lack of initial credentials. Using permanent IAM user keys is less secure. Security groups control network access, not IAM permissions.

3. Final Answer:

   Attach an IAM role with S3 permissions to the EC2 instance and use the instance profile to assume the role automatically. -> Option C

4. Quick Check:

   EC2 uses instance profile role for temporary access [OK]

Hint: Use instance profile roles for EC2 temporary access [OK]

Common Mistakes:

• Using permanent keys on EC2 instead of roles
• Trying to assume role without attached IAM role
• Confusing security groups with permissions