S3 Cross account IAM Roles and Globus

[Ken Carlile]

Hi all, 

I wanted to check if anyone has had success with using AWS cross account IAM roles with the Globus S3 connector, and if so, how you did it. As I understand it, when using this type of authentication, a user has a set of keys that don't directly grant access to the bucket. Rather, they need to use an IAM role to get to the bucket. Sorry if this is vague, it's kind of new to me. But the upshot is, my user doesn't have a keypair that will directly access the bucket, and that keypair doesn't even really exist. 

I was referred to these docs by our S3 admin: 

https://repost.aws/knowledge-center/cross-account-access-s3

https://docs.aws.amazon.com/AmazonS3/latest/userguide/example-walkthroughs-managing-access-example2.html

Thanks, 

Ken

[Brigitte Raumann]

Hi Ken,

Unfortunately, the S3 connector does not currently support access via IAM roles.  We have had users request this feature before, and it is on our backlog.  I'll note your interest on the backlog ticket.

Brigitte

Globbus Product Manager

[Ken Carlile]

OK, thanks. Our S3 admin thinks he has a workaround for the time being. At least once we resolve the other S3 issue, which we have an open ticket on. 

[Brigitte Raumann]

OK, thanks.  Not that this provides support for S3 access using IAM roles, but I did want to flag that we recently released support for multiple S3 keys to allow for cross account access with keys.

Brigitte

[Michael Gutteridge]

Ken- do you think it possible to share your S3 admin's workaround here?  I think we're struggling with similar issues.

Thanks

 - Michael

[Ken Carlile]

Hi Michael, 

He said he's using (what is probably Karl's) instructions here: https://globus.stanford.edu/cloud/s3.html

--Ken