Andrea Danti - Fotolia

Gain control over multiple AWS accounts with IAM

Our environment has multiple AWS accounts for different dev stages. How can we use the IAM cross-account feature to share resources across accounts?

The AWS IAM service enables managers to define authorization levels for different user groups and securely control access to various AWS cloud resources. But when an organization uses multiple AWS accounts, each one has different resource-level permissions. Therefore, one account cannot access the other account's resources. AWS provides a cross-account access feature that enables control across multiple AWS accounts.

With the Identity and Access Management cross-account feature, administrators can grant permissions to appropriate users in each account. This enables users to draw data from its origin without replicating storage resources across multiple AWS accounts. Users then can access staging and production resources from a single console.

For example, an organization might have one AWS account for production and another for its staging environment. The IT team constructs the staging account to provide IAM users permissions, as required for their roles. Admins grant access to developers, for example, to read and write objects to all Amazon Simple Storage Service (S3) buckets, but they do not have permission to delete, create or modify attributes of the bucket itself. Testers have read access, but they do not have write access -- nor can they modify bucket attributes.

With the IAM cross-account feature, administrators can grant permissions to appropriate users in each account.

Therefore, the AWS production account doesn't have built-in IAM users or roles, which helps secure sensitive data. The staging environment needs to access certain objects, but the organization doesn't want staging account users to log into the production account. It's possible to continuously replicate production data to staging, but this increases cost and can weaken security. The cross-account access feature handles this problem.

Cross-account access for multiple AWS accounts

Authenticate staging account users to access the production account to allow them to use production resources. It's best to define permissions for IAM users in the staging environment so you can access the production S3 bucket. IAM users in the staging account then use the IAM cross-account access feature to use production resources; there's no need to create IAM roles in the production account.

Next Steps

Prepare for multiple AWS accounts in the architecture design phase

Differentiate use cases for IAM roles or users

Manage resource access with IAM permissions

Dig Deeper on AWS security