AWS Assume Role Steps

aws-cross-account-assume-role.txt

For example, Account A needs to push docker images to Account B:

High level steps:
* Trust relationship will tell from where the request is originating
* Policy will tell what access the role has

* Account B's role will have trust relationship to Account A
* Account B's role will have access to push the image to ECR

* Account A's role will have trust relationship to EC2(as request is originating from EC2(jenkins))
* Account A's role will have access to assume Account A's role

On Account B:
* Create a Role in Account B, name it as jenkins-role
* Add Trust Relationship as below to the Role and replace <AccountA_ID>
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": {
        "AWS": "arn:aws:iam::<AccountA_ID>:root"
      },
      "Action": "sts:AssumeRole",
      "Condition": {}
    }
  ]
}

* Attach policy to the Role in Account B as below
{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "ECR",
            "Effect": "Allow",
            "Action": [
                "ecr:*"
            ],
            "Resource": "*"
        }
    ]
}

-------------------------------------------------------------

On Account A:
* Create a Role in Account A
* Add Trust Relationship as below and replace <AccountB_ID>
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "",
      "Effect": "Allow",
      "Principal": {
        "Service": "ec2.amazonaws.com"
      },
      "Action": "sts:AssumeRole"
    }
  ]
}

* Attach policy to the role in Account A as below
{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": "sts:AssumeRole",
            "Resource": "arn:aws:iam::<AccountB_ID>:role/jenkins-role"
        }
    ]
}

* Attach the role to the jenkins ec2 instance