Granting AWS resources access to a third party app

Question

I have a use-case, where the users of an app are required to grant temporary access to their AWS Account. Looking for an Oauth style solution, where the user is directed to the AWS Auth interface and redirected back on successful auth. In the process, the user granting temporary access to the required AWS resources.

The closest use-case: https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_common-scenarios_third-party.html

But I may not be able to apply the solution directly.

Answer 1

The service you are looking for is Cognito Identity Pools. They can integrate with many OAuth providers and are used to get temporary access to several AWS Services e.g. DynamoDB, S3 etc.

You may look into this tutorial to get more idea on how it works. Cognito User Pool is not required and may be replaced by any other IdP or SSO like Auth0, Okta, FB etc.

Let's say you want to access services from multiple accounts e.g. AccountA and AccountB. If AccountA has Cognito Identity pool, you will have to do following steps:

• Create an IAM Role in AccountB and add access to the services you want to access in the app. You will have to create it using Another AWS account option and provide AccountID of AccountA.
• In the AccountA, create an IAM Role that allows access to services from current account and that will be attached to your Cognito Identity Pool. More details here.
• Add this policy to AccountA Role, so it can assume role from AccountB.

{
  "Version": "2012-10-17",
  "Statement": {
    "Effect": "Allow",
    "Action": "sts:AssumeRole",
    "Resource": "arn:aws:iam::AccountB_ID:role/account_b_role"
  }
}

To access services of AccountA:

• Simply get temporary credentials from Cognito Identity Pool and use them in SDK as:

AWS.config.update({
    region: "us-east-1",
    credentials: new AWS.Credentials('AccessKeyId', 'SecretAccessKey', 'SessionToken')
});

To access services of AccountB:

• Set AccountA credentials as done above.
• Assume AccountB Role and get temporary credentials from it.
• Set these credentials to access AccountB Services.

This solution can be extended to any number of accounts.