0
0

Delete article

Deleted articles cannot be recovered.

Draft of this article would be also deleted.

Are you sure you want to delete this article?

MFA設定ありのRoleでCross-Accountリソースアクセス

Last updated at Posted at 2025-03-01

はじめに

Cross Account間のリソースアクセスには、roleの利用が一つのやり方です。
さらにMFA設定が有効な場合のCLIの実行方法を試します。

構成

Account-BにおけるUser01から、Account-Aのリソースをアクセスします。

  • AWS Account
    • Account-A: 12345678900
    • Account-B: 00123456789
  • Account-A: 12345678900
    • Role:role-s3-for-other-account作成
      • Policy: AmazonS3FullAccess
      • Trust relationships:
        • Account-Bのユーザから及びMFA必須設定
  • Account-B: 00123456789
    • User01のPolicy設定
      • Role「role-s3-for-other-account」へのAssumeRole許可
    • User01のMFA設定

  • Account-A
    image.png
{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "Statement1",
            "Effect": "Allow",
            "Principal": {
                "AWS": "arn:aws:iam::00123456789:root"
            },
            "Action": "sts:AssumeRole",
            "Condition": {
                "Bool": {
                    "aws:MultiFactorAuthPresent": "true"
                }
            }
        }
    ]
}
  • Account-B
    image.png
{
    "Version": "2012-10-17",
    "Statement": {
        "Effect": "Allow",
        "Action": "sts:AssumeRole",
        "Resource": "arn:aws:iam::12345678900:role/role-s3-for-other-account"
    }
}

CLI利用

aws credential設定

config file

[profile tmp01-role]
role_arn = arn:aws:iam::12345678900:role/role-s3-for-other-account
source_profile = tmp
mfa_serial=arn:aws:iam::00123456789:mfa/myMFA01

credentials

[tmp]
AWS_ACCESS_KEY_ID=xxxxxxxxxx
AWS_SECRET_ACCESS_KEY=xxxxxxxxxxyyyyyy

Account-Aのbucketにアクセス

MFA Codeを入力した後、Account-Aにあるbucketが表示されます。

aws --profile tmp01-role s3 ls
Enter MFA code for arn:aws:iam::00123456789:mfa/myMFA01:
0
0
0

Register as a new user and use Qiita more conveniently

  1. You get articles that match your needs
  2. You can efficiently read back useful information
  3. You can use dark theme
What you can do with signing up
0
0

Delete article

Deleted articles cannot be recovered.

Draft of this article would be also deleted.

Are you sure you want to delete this article?