Cross-account access is a feature provided by Amazon Web Services (AWS) that allows users to securely access resources and services in another AWS account. With cross-account access, organizations can grant permissions to trusted entities or external partners without the need for sharing credentials or creating separate accounts.
By using cross-account access, organizations can maintain better control over their resources while still allowing authorized users from other accounts to interact with those resources. This enables collaboration and simplifies management of multiple AWS accounts within an organization.
To establish cross-account access, the owner of the target account must set up an IAM role with specific permissions and trust relationships with the source account. The source account then grants permission to its users or roles to assume this IAM role in the target account.
Once cross-account access is established, users from the source account can assume roles in the target account and perform actions based on their assigned permissions. This provides a secure way for different accounts to work together seamlessly within an AWS environment.
Cross-account access is commonly used in scenarios such as:
Sharing data between multiple AWS accounts.
Centralized billing management across different business units.
Enabling third-party auditors or consultants to assess security controls.
Providing temporary administrative privileges for troubleshooting purposes.
In conclusion, cross-account access in AWS offers a flexible and secure solution for managing resources across multiple accounts. By leveraging this feature, organizations can enhance collaboration while maintaining strong security practices within their cloud infrastructure.
Make sure you have the Infoblox Account ID and External ID before creating the AWS role.
Cross account access through the AWS console
Complete the following steps to configure cross account access through AWS console.
Login to an AWS account.
Go to IAM > Roles and click Create Role. Select trusted entity as Another AWS account and provide account ID of Infoblox account (this is present in the Cloud Services Portal as Principal ID). Provide External ID shared by Infoblox (this is present in the Cloud Services Portal as External ID). Using External ID is mandatory. Click Next.
Configure the Provider Type as IPAM/DHCP and Permissions Required as ReadOnlyAccess. Attach the permission policy and click Next.
Add the Role Name as infoblox_discovery.
You must add the Role Name as infoblox_discovery. Follow this step to avoid any configuration issues.
Trusted Entities Policy will shown as follows:
|
Click Create Role and the role would be created.
Specify the tags as per your organization’s rules on the role.
Cross account access through AWS CLI
Complete the following steps to configure cross account access through AWS CLI:
Run the following command with role name shared by Infoblox and a policy like role.json.
|
|
After executing the above command, the role should be created successfully with the following output:
|
Attach required permission (ReadOnlyAccess).
|
The role-name is the same created above which is shared by Infoblox.
In this example, we have attached Default Policy of ReadOnlyAccess which would give Read Access over the entire account. However, you can choose to attach a custom Read Access which will give read access over some resources as required.