0

I am looking to use AWS STS to access resources from another AWS account owned by another team.

say, AWS Account A trying to access AWS Account B.

basically the steps I am following:
1. Create a user in Account A
2. Create Role in Account B with the necesaary permissions
3. Add assume role permissions for user in Account A
4. Use User credentials to get temporary credentials for Account B.
5. Use temp credentials on Account B.

But, after reading through a ton of AWS docs, I am unable to figure out which account gets billed for the cross account API calls?

4
  • Given that IAM does not charge (aws.amazon.com/iam/faqs), I'd assume that STS is the same. Use of the credentials to interact with other services, e.g. EC2, would potentially be chargeable, of course.
    – jarmod
    Nov 27, 2017 at 19:49
  • hmm interesting, but usingEC2 is chargeable to which account though? Nov 27, 2017 at 20:19
  • If you use temp credentials on Account B, and EC2 instance will be created in Account B. So, the charge will be in Account B (unless it is under consolidated billing/Organizations, but that's different topic..)
    – sudo
    Nov 27, 2017 at 20:21
  • 1
    Yes, the account that owns the resource (EC2 instance in this case) pays. One situation where the user of the resource pays is S3, specifically where the bucket owner has configured 'requester pays'.
    – jarmod
    Nov 27, 2017 at 20:38

2 Answers 2

3

When you use AssumeRole to grant access to another Amazon account (account B), your identity switches to the other account with the username being the role name that you assumed.

The only cross account API being called will be AssumeRole. After this succeeds you will be using the APIs using account B's temporary credentials that were returned from AssumeRole.

All ownership, billing, etc. will be the same as if you had originally logged into account B as a normal IAM user except for the user name.

CloudTrail records STS type calls such as AssumeRole and logs all authenticated API requests. Once AssumeRole succeeds, your activity (using the temporary credentials) will be logged by CloudTrail in account B. This assumes of course that CloudTrail is enabled.

This link will give you more details into the user identity that AWS uses when using AssumeRole.

CloudTrail userIdentity Element

1

When you create a role for cross-account access, you establish trust from the account that owns the role and the resources (trusting account) to the account that contains the users (trusted account). To do this, you specify the trusted account number as the Principal in the role's trust policy. That allows potentially any user in the trusted account to assume the role. To complete the configuration, the administrator of the trusted account must give specific groups or users in that account permission to switch to the role. Link

As everyone has mentioned a user from the account A is just assuming a role in account B to temporary access resources in account B,ownership stays still and the owner pays for the resources he owns. In this case it is the account B who pays. STS is the service being used to assume a role and is part of IAM.

The following was taken from IAM FAQ.

Q: How do I assume an IAM role? You assume an IAM role by calling the AWS Security Token Service (STS) AssumeRole APIs (in other words, AssumeRole, AssumeRoleWithWebIdentity, and AssumeRoleWithSAML). These APIs return a set of temporary security credentials that applications can then use to sign requests to AWS service APIs.

Q: How many IAM roles can I assume? There is no limit to the number of IAM roles you can assume, but you can only act as one IAM role when making requests to AWS services.

Q: Who can use IAM roles? Any AWS customer can use IAM roles.

Q: How much do IAM roles cost? IAM roles are free of charge. You will continue to pay for any resources a role in your AWS account consumes.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.