Intro
AWS is one of the most popular cloud service providers nowadays.
During the writing of this blog post, AWS has ~33% of the market, so it's very probably you will work with AWS, or you're already working with them 😉.
In today's blog post, I will show you how to assume an IAM role using Python and boto3 library to access another AWS account.
Sometimes you need to access something from a different AWS account. It is called cross account access.
For example, you may want to get a secret from the secrets manager.
By default, it is not possible, but AWS comes with a solution.
You can assume the role that has permission to the actions you want to do.
Once you do this, you can act on the other account.
You can read more about it here.
This blog post will be different,
I'm not going to go into details about what boto3 is,
or what iam role is.
Instead, I will jump straight to the code.
Code
I will use the example from the intro section. We want to delete a secret from the secrets manager on a different AWS account.
The code together with the tests
is also available on my GitHub here 🚀.
# blog/examples/src/assume_iam_role/delete_secret.py
import os
from typing import Any
import structlog
from boto3 import Session
from botocore.exceptions import ClientError
from src.assume_iam_role import LambdaEvent, SecretsManagerSdkClient, STSSdkClient
from src.assume_iam_role.errors import SecretsDeletionError
LOGGER = structlog.get_logger()
def handle(event: LambdaEvent, context: Any, sts_sdk_client: STSSdkClient) -> LambdaEvent:
if "ROLE_ARN_TO_ASSUME" not in os.environ:
return event
try:
secret_id = event["secret_id"]
response = sts_sdk_client.assume_role(
RoleArn=os.environ["ROLE_ARN_TO_ASSUME"],
RoleSessionName="blogpost-delete-secret",
)
session = Session(
aws_access_key_id=response["Credentials"]["AccessKeyId"],
aws_secret_access_key=response["Credentials"]["SecretAccessKey"],
aws_session_token=response["Credentials"]["SessionToken"],
)
client: SecretsManagerSdkClient = session.client("secretsmanager")
LOGGER.info(f"Deleting secret from secretsmanager! secret_id={secret_id}")
response = client.delete_secret(SecretId=secret_id, ForceDeleteWithoutRecovery=True) # type: ignore
LOGGER.info(f"Successful request! Response = {response}")
return event
except ClientError as error:
if error.response["Error"]["Code"] == "ResourceNotFoundException":
return event
LOGGER.error(f"An error occurred during request to SecretsManager service. Error = {error}")
raise SecretsDeletionError
except Exception as error:
LOGGER.error(f"An unknown error occurred during `delete_secret.handle` function execution. Error = {error}")
raise SecretsDeletionError
and the test:
# blog/examples/tests/test_assume_iam_role/conftest.py
import os
from typing import Generator
import boto3
import pytest
from _pytest.monkeypatch import MonkeyPatch
from moto import mock_secretsmanager, mock_sts
from src.assume_iam_role import SecretsManagerSdkClient, STSSdkClient
@pytest.fixture(autouse=True)
def aws_envs() -> None:
os.environ["AWS_REGION"] = "eu-west-1"
os.environ["AWS_DEFAULT_REGION"] = "eu-west-1"
os.environ["AWS_ACCESS_KEY_ID"] = "XXX"
os.environ["AWS_SECRET_ACCESS_KEY"] = "XXX"
@pytest.fixture()
def different_account_id() -> str:
return "111111111111"
@pytest.fixture()
def secret_id() -> str:
return "/test/secret/blogpost/szymonmiks"
@pytest.fixture()
def mock_sts_client() -> Generator[STSSdkClient, None, None]:
with mock_sts():
client: STSSdkClient = boto3.client("sts")
yield client
@pytest.fixture()
def mock_secrets_manager_client(
secret_id: str, monkeypatch: MonkeyPatch, different_account_id: str
) -> Generator[SecretsManagerSdkClient, None, None]:
with mock_secretsmanager():
# http://docs.getmoto.org/en/latest/docs/multi_account.html#configure-an-account-using-sts
monkeypatch.setenv("MOTO_ACCOUNT_ID", different_account_id)
client: SecretsManagerSdkClient = boto3.client("secretsmanager")
client.create_secret(Name=secret_id)
yield client
from _pytest.monkeypatch import MonkeyPatch
from src.assume_iam_role import LambdaEvent, SecretsManagerSdkClient, STSSdkClient
from src.assume_iam_role.delete_secret import handle
def test_can_delete_secret_using_assumed_role(
mock_sts_client: STSSdkClient,
mock_secrets_manager_client: SecretsManagerSdkClient,
monkeypatch: MonkeyPatch,
secret_id: str,
different_account_id: str,
) -> None:
# given
event = LambdaEvent({"secret_id": secret_id})
monkeypatch.setenv("ROLE_ARN_TO_ASSUME", f"arn:aws:iam::{different_account_id}:role/test_role_to_assume")
# when
result = handle(event, None, mock_sts_client)
# then
assert result == event
assert mock_secrets_manager_client.list_secrets()["SecretList"] == []
That’s it. As simple as that 😄.
Happy coding 😉 .
Top comments (0)