AWS re:Post을(를) 사용하면 다음에 동의하게 됩니다. AWS re:Post 이용 약관

Do I need to create a IAM user to assume a role?

0

I created an application in typescript that talks to AWS Fargate tasks. But I need to create temporary access and secret keys to be used in the application. Do I need to create an IAM user and assign the role to be assumed by that user, or, is it possible to use the IAM Role that has the required permissions in the application without providing an IAM user creds?

질문됨 일 년 전1천회 조회
1개 답변
3
수락된 답변

To your question, IAM roles can be assumed by IAM User and IAM role. Please refer Use IAM Roles for complete list of who can assume roles and method of assuming role.

Additionally refer Temporary credentials request.

Your application can leverage either IAM User or IAM Roles Anywhere for this purpose.

  1. With IAM User, IAM user would have access of AssumeRole for that role and you'd make sure that IAM role has all the required permissions to access AWS resources, which your typescript application needs. IAM user would be considered simple but less secure way of doing this as you'll store the access key and secret access key somewhere and can be leaked. If you go with IAM user route, I'd advise you to keep rotating them periodically and use variables for these and store them in a file and that credential file can be read by specific set of users only.

  2. IAM Roles Anywhere is relatively new feature and cal also be used in this use case, please refer following two blog posts, which covers the topic and provide guidance, how to set it up:

Hope this explanation helps.

Abhishek

profile pictureAWS
전문가
답변함 일 년 전
profile picture
전문가
검토됨 5달 전
profile pictureAWS
전문가
검토됨 일 년 전
  • If the application is running outside of AWS, I would then need an IAM user tied to that assumed role correct?

  • There are two ways, you can do that, one is use IAM user and that IAM user would have assume role permissions for the role that has all the required permissions.

    Other one is IAM role anywhere, relatively new feature for same use case. I have added these details to my answer too.

    Don't hesitate to ask further questions, happy to help.

로그인하지 않았습니다. 로그인해야 답변을 게시할 수 있습니다.

좋은 답변은 질문에 명확하게 답하고 건설적인 피드백을 제공하며 질문자의 전문적인 성장을 장려합니다.

질문 답변하기에 대한 가이드라인

관련 콘텐츠