IAM Role for an IAM User within same account for Console Access

Question

I am trying to create an IAM user and I want to assign the user for Full S3 Access using IAM role (via console access). I know I can do that using Group or attaching the S3FullAccessPolicy directly to the user. I am unable to do this and could not find any help regarding this. The articles I come across describes how you can attach IAM policies to EC2 instance etc.

I managed to create a role and attached a trust policy as below. I also attached the policy "AmazonS3FullAccess" to the role.

But it never worked if I login using AWS management console (browser). It still denies all permission to the user for S3 access. The trusted entities policy looks like below - the IAM username I am trying to use is s3AdminUserWithRole. Th eAWS account id is 6XXXXXXXXXXX0

  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": {
        "AWS": [
          "arn:aws:iam::6XXXXXXXXXXX0:user/s3AdminUserWithRole",
          "arn:aws:iam::6XXXXXXXXXXX0:root"
        ]
      },
      "Action": "sts:AssumeRole",
      "Condition": {}
    }
  ]
}

Is it not possible to do like this for AWS Management console for a user? We have to use only Groups /managed policies/ inline policies and NOT roles for this? Confused about the AWS documentation then.

You want your user to use only this IAM role to access S3? If so user has to assume the role first. Roles are not automatically attached to any users. — Marcin
That's what I tried to attach above JSON policy. But it didn't work — SRaj
You don't attach the role to your user. Instead your user has to use sts service and its assume-role api (for console there is option to switch role). — Marcin
Thank you so much. Exactly what I was looking for. If you put this answer in the main section, I can accept is as answer and you'll get points too. — SRaj

Marcin Marcin · Accepted Answer · 2020-03-08T10:01:09

Based on the comments, the solution is to use sts service and its assume-role API.

For Console there is Switch Role option.

IAM Role for an IAM User within same account for Console Access

1 Answers