The best way to you create a Cross Account Function in Terraform

To create a cross-account position in Terraform, that you must carry out the next steps:

1. Outline the IAM position

Outline the IAM position within the Terraform configuration

useful resource "aws_iam_role" "cross_account_role" {
  identify               = "CrossAccountRole"
  assume_role_policy = <<EOF
{
  "Model": "2012-10-17",
  "Assertion": [
    {
      "Effect": "Allow",
      "Principal": {
        "AWS": "arn:aws:iam::<ACCOUNT_ID>:root"
      },
      "Action": "sts:AssumeRole"
    }
  ]
}
EOF
}

Within the assume_role_policy part, exchange <ACCOUNT_ID> with the AWS account ID of the goal account that can assume this position.

2. Connect the mandatory insurance policies

Connect the mandatory insurance policies to the position. Insurance policies outline the permissions granted to the position

useful resource "aws_iam_role_policy_attachment" "cross_account_role_attachment" {
  position       = aws_iam_role.cross_account_role.identify
  policy_arn = "arn:aws:iam::aws:coverage/AmazonS3ReadOnlyAccess"  # Instance coverage
}

Change "arn:aws:iam::aws:coverage/AmazonS3ReadOnlyAccess" with the ARN of the coverage you wish to connect to the position.

3. Create a task belief relationship

Create a task belief relationship within the goal AWS account to permit the cross-account entry. This step is carried out outdoors of Terraform. You should log in to the goal AWS account and create a task belief coverage for the position created within the earlier steps.

Right here’s an instance of the belief coverage in JSON format:

{
  "Model": "2012-10-17",
  "Assertion": [
    {
      "Effect": "Allow",
      "Principal": {
        "AWS": "arn:aws:iam::<SOURCE_ACCOUNT_ID>:root"
      },
      "Action": "sts:AssumeRole"
    }
  ]
}

Change <SOURCE_ACCOUNT_ID> with the AWS account ID the place the position is created.

4. Use the created cross-account position

Use the created cross-account position in different assets by specifying the ARN of the position:

useful resource "aws_s3_bucket" "example_bucket" {
  bucket = "example-bucket"

  # Specify the ARN of the cross-account position
  role_arn = aws_iam_role.cross_account_role.arn
}

Bear in mind to execute terraform init, terraform plan, and terraform apply to initialize the Terraform configuration, plan the adjustments, and apply them to create the cross-account position.

5. What it’s important to do within the goal account

Along with creating the IAM position within the supply account utilizing Terraform, you additionally have to carry out the next steps within the goal account to ascertain the cross-account entry:

1. Log in to the AWS Administration Console of the goal account.
2. Navigate to the IAM service.
3. Create a brand new IAM position that can assume the cross-account position.
4. Connect a belief coverage to the newly created position to permit the supply account to imagine this position.
   • Click on on “Belief relationships” for the position.
   • Click on on “Edit belief relationship.”
   • Specify the belief coverage doc with the mandatory permissions. Right here’s an instance of the belief coverage in JSON format:

{
  "Model": "2012-10-17",
  "Assertion": [
    {
      "Effect": "Allow",
      "Principal": {
        "AWS": "arn:aws:iam::<SOURCE_ACCOUNT_ID>:root"
      },
      "Action": "sts:AssumeRole"
    }
  ]
}

Change <SOURCE_ACCOUNT_ID> with the AWS account ID the place the cross-account position is created.

• Click on on “Replace Belief Coverage” to avoid wasting the adjustments.

5. As soon as the belief coverage is ready up, you should use the ARN of the cross-account position within the supply account to grant the mandatory permissions to assets within the goal account.

By configuring the belief coverage within the goal account, you permit the required position within the supply account to imagine the cross-account position and entry assets within the goal account.