9

I followed the instructions mentioned in an AWS developer forum post (now no longer available).

Policy

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "VisualEditor0",
            "Effect": "Allow",
            "Action": [
                "ssm:GetParametersByPath",
                "ssm:GetParameters",
                "ssm:GetParameter"
            ],
            "Resource": "arn:aws:ssm:eu-central-1:XXXXXXXXXX:parameter/some-root/*"
        },
        {
            "Sid": "VisualEditor1",
            "Effect": "Allow",
            "Action": "ssm:DescribeParameters",
            "Resource": "*"
        }
    ]
}

I attached the policy to the target account in a role

When I get the parameters from the source account it works, however I can't access them from the target account.

C:\Users\my-home>aws ssm get-parameters-by-path --path "/some-root/" --profile aws-acc-src
{
    "Parameters": [
        {
            "Name": "/some-root/dev",
            "Type": "SecureString",
            "Value": "AQICAHh5z4qygT6rbxBnR/PmJn811vO30kBJNB+JrB1tdKNBeAEHFLSQDpTMsRMc1l0D8lXYAAAAYTBfBgkqhkiG9w0BBwagUjBQAgEAMEsGCSqGSIb3DQEHATAeBglghkgBZQMEAS4wEQQM+Qmz5FoNcESEXabnAgEQgB6MdOlb545EPN61QqA50w7rH3sghmNWvxsLPPneHEA=",
            "Version": 1,
            "LastModifiedDate": "2020-10-06T16:03:32.637000+03:00",
            "ARN": "arn:aws:ssm:eu-central-1:XXXXXXXX:parameter/some-root/dev"
        }
    ]
}

aws ssm get-parameters-by-path --path "/some-root/" --with-decryption --profile aws-acc-src
{
    "Parameters": [
        {
            "Name": "/some-root/dev",
            "Type": "SecureString",
            "Value": "foo",
            "Version": 1,
            "LastModifiedDate": "2020-10-06T16:03:32.637000+03:00",
            "ARN": "arn:aws:ssm:eu-central-1:XXXXXXXX:parameter/some-root/dev"
        }
    ]
}

aws ssm get-parameters-by-path --path "/some-root/" --with-decryption --profile aws-acc-target
{
    "Parameters": []
}
Efren
  • 4,003
  • 4
  • 33
  • 75
aspdeepak
  • 2,640
  • 2
  • 32
  • 37
  • 1
    You need to assume the role in the source account from the target account first, using `aws sts assume-role`. There's more details on this step in the last post in that forum thread. – Tim Malone May 08 '21 at 09:08

2 Answers2

6

It looks like, the parameter store doesn't support cross account access. Alternatively you can use secrets manager to share secrets between different AWS accounts.

https://medium.com/awesome-cloud/aws-difference-between-secrets-manager-and-parameter-store-systems-manager-f02686604eae

ManojKumarAlagudurai
  • 126
  • 2
  • 5
2

I'd recommend creating the parameter in all accounts using a CloudFormation stackset. That is an easy way to distribute it to accounts and regions and to apply and maintain the value in sync across all.

I'd also put a feature request through AWS Support (I'll do myself). The more requests for the feaure the more probable it gets implemented in the future.

jaferrando
  • 21
  • 2