Anatomy of IAM Policies in AWS

Account A · 222222222222

Assume Role Policy — attach to RoleA and AdminA in the source account.

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": "sts:AssumeRole",
      "Resource": "arn:aws:iam::111111111111:role/RoleB"
    }
  ]
}

• Account B is our “destination”.
• Account A is our “source”.
• We want users or resources in Account A to be able to assume a role in Account B.
• Once a user or resource assumes the role in Account B, requests made with the temporary role credentials use the role session’s permissions, not the original identity’s permissions. Other applicable policies can further restrict access.
• For example, admin privileges in Account A do not carry over into a limited RoleB session in Account B. To act with their original permissions again, the caller uses their original credentials or switches back in the console; assuming RoleB does not revoke those permissions.
• While using RoleB, RoleA and user AdminA will be able to view the desired logs in Account B, provided no other applicable policy blocks access.
• This all works thanks to temporary security credentials issued via the AWS Security Token Service (STS).

Account B · 111111111111

Trust Relationship Policy — defines who can assume RoleB in the destination account.

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": {
        "AWS": [
          "arn:aws:iam::222222222222:role/RoleA",
          "arn:aws:iam::222222222222:user/AdminA"
        ]
      },
      "Action": "sts:AssumeRole"
    }
  ]
}

Permissions Policy — defines what RoleB can do. These example log groups are in us-east-1.

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "logs:GetLogEvents",
        "logs:FilterLogEvents",
        "logs:DescribeLogStreams"
      ],
      "Resource": [
        "arn:aws:logs:us-east-1:111111111111:log-group:log-group-name-1:*",
        "arn:aws:logs:us-east-1:111111111111:log-group:log-group-name-2:*"
      ]
    }
  ]
}