initiate aws ssm from jenkins in one account to ec2 in another instance for data transfer

Question

Background: I have jenkins installed in AWS Account #1 (account1234) and it has iam Role-jenkins attached to it. There's github configured with Jenkins.
When I click build job in Jenkins, jenkins pulls all the files from github and can be found in

/var/lib/jenkins/workspace/.

There's an application running in AWS Account #2 (acccount5678) in an ec2 instance (i-xyz123) and the project files are in /home/app/all_files/ ; This ec2 instance role has app-role attached to it.

What I'm trying to achieve: When I click build, I want jenkins to push files from account 1234 to account 5678 by opening an SSM session from Jenkins ,to the ec2 instance on which app is running.

What I tried: In the jenkins as part of build shell script I added:

aws ssm send-command --region us-east-1 --instance-ids i-xyz123 --document-name AWS-RunShellScript --comment IP config --parameters commands=ifconfig --output text

to test it. (If successful, I want to pass cp var/lib/jenkins/workspace/ /home/app/all_files/ as the command)

Error:

An error occurred (AccessDeniedException) when calling the SendCommand operation: User: arn:aws:sts::account1234:assumed-role/Role-Jenkins/i-01234abcd is not authorized to perform: ssm:SendCommand on resource: arn:aws:ec2:us-east-1:account1234:instance/i-xyz123 Build step 'Execute shell' marked build as failure Finished: FAILURE

Issue 1: instance/i-xyz123 is in account5678 but error above shows ssm trying to connect to instance in account1234 ( which shouldn't be happening)

Q1: How do I update my command so that it tries to open an ssm session with instance/i-xyz123 present in account5678 to accomplish what I'm trying to do.

I believe I would also need to make each role added as a trusted relationship to the other.

(Note I want to do it via sessions manager as I won't have to deal with credentials of any sort)

Answer 1

If I've understood correctly then you're right; to interact with the resources in account5678, there needs to be a trust relationship so that the Jenkins account can assume the relevant role in account5678 and call SSM from there.

Once you've configured the role relationship (ref: IAM cross account roles )

You should be able to achieve what you need by assuming the role first in your shell script and then running the ssm command. That way Jenkins will use the temp creds and execute the command in the correct account (5678).

This site steps through it pretty well : Tom Gregory - Jenkins Assume Role

If you just cmd/ctrl f on that page ^ and search for 'shell' you should get to the section you need. Hope this somewhat helps.