Skip to main content

Cross Account Read Access

To let a CAIP Workflow read data in an external AWS account grant its execution role permission to assume a role in that account. This uses short lived role chaining, no static AWS keys.

Note:

You need administrative access to the external AWS account and a spaceId on CAIP with permission to raise OMS orders. Repeat the OMS order for each stage you want to enable.

The setup has two sides:

  1. CAIP side. Raise an OMS order attaching an sts:AssumeRole policy to the workflow execution role.
  2. External account side. Deploy a CloudFormation template creating the role to assume with read only access to the resources to share.

1. Create the CAIP policy through OMS​

In OMS (prod) open Orders (/v1/spaces/{spaceId}/orders) and create a Create custom IAM permission order:

You can assign multiple stages to the same order (i.e. int, test, prod), to apply the same permission to multiple stages within your usecase.

{
  "scope": "iam-permission:create",
  "payload": {
    "name": "Assume external read-only role",
    "policyDocument": {
      "Version": "2012-10-17",
      "Statement": [
        {
          "Sid": "AssumeExternalReadOnlyRole",
          "Effect": "Allow",
          "Action": "sts:AssumeRole",
          "Resource": "arn:aws:iam::<EXTERNAL_ACCOUNT_ID>:role/<EXTERNAL_ROLE_NAME>"
        }
      ]
    },
    "stages": ["<stage>"],
    "roleTypes": ["service"]
  }
}

Replace <EXTERNAL_ACCOUNT_ID>, <EXTERNAL_ROLE_NAME>, and <stage> (test/int/e2e/prod, the stage your workflow version is assigned to).

2. Create the role to be assumed (external account)​

Once the OMS order is fulfilled generate a CloudFormation template for the external account:

Loading template generator…

Fill in the role name. The CAIP role ARN(s) from your OMS order. The external account ID. And pick the read access types (S3, Glue, or CDH dataset). Deploy the template in the external AWS account. It creates only the assumable role. It does not touch existing buckets, databases, or KMS keys.

For CDH resource permissions see the CDH resource permissions guide.

3. Validate the connection​

Once the OMS order is fulfilled and the CloudFormation stack is CREATE_COMPLETE or UPDATE_COMPLETE in AWS:

  1. Confirm the OMS policy is attached to the execution role.
  2. From a CAIP Workflow assume the external role and read a known object or table.
  3. Confirm a write (s3:PutObject / glue:CreateTable) is denied.
  4. If prefix scoped confirm an object outside the prefix cannot be read.