The STS Assume role allows temporary access to AWS resources within your account, or for cross-account access, by returning a set of temporary security credentials, including an access key ID, a secret access key, and a security token.
Instructions in this section contain the following designations:
- Account A refers to the AWS Production account.
- Account B refers to the AWS Development account.
- Open Collector is installed. If you have not already installed it, follow the instructions in the Open Collector Installation and User Guide, and then return to this topic.
- AWS queues are set up.
- The event on the Account A bucket is configured so that the actions performed on the bucket are sent to the queue from which the s3beat service is listening.
- The queues and bucket are on the same region, and the proper permission has been granted to the queue.
- AWS Cross Account Access Using STS Assume Role
- AWS S3-SQS Cross Account Access Configuration.
- An AWS Production account (Account A) whose resources should be accessed by an AWS Development account (Account B) via the STS assume role.
- An ARN of the role created on Account A.
The following port is open:
Outbound 443 HTTPS AWSS3 Beat
Requirements for an STS Assume Role on an existing AWS S3 Beat
- With STS you do not need to share the long term actual credentials of your production/security account.
- The AWS S3 Beat will request the temporary credential using ARN for assume role that will expire after a certain time interval and can be refreshed after that.
- To assume a role from a different account, your AWS account must be trusted by the role. The trust relationship is defined in the role's trust policy when the role is created. That trust policy states which accounts are allowed to delegate that access to users in the account.
AWS S3 STS Assume Role Analysis
The table below lists the parameters required to configure the STS Assume role on the AWS S3 beat.
|Key||User Input Prompt||Default Value||Description|
|assumeRoleFlag||y/N||N (false)||Assume Role cross-account access enable/disable flag. If the flag is enabled (y), the user must provide the ARN value. If the flag is disabled (N), then nothing changes in the existing beat functionality.|
Provide the Assume Role ARN.
This prompt only appears if the user has enabled assumeRoleFlag (y).
empty string array
The Assume Role ARN for cross-account access created during AWS Console configuration.
The maximum session duration for the Assume Role access. Range: 15 minutes to 12 hours (Default: 1 hour).
This setting should always be less than or equal to the maximum session duration set for the corresponding Assume Role on AWS.
Deploying the STS Assume Role on a running AWS S3 Beat requires migration. During migration, the parameters in the table above will be added in the s3beat.yml with their default values. After migration, you must restart the AWS S3 Beat to enable the STS Assume Role feature.
If you deploy the STS Assume Role on a non-running AWS S3 Beat, you will be prompted to input the parameters in the table above.