通过Lambda跨账号访问S3的CloudFormation配置方案咨询

核心说明 #

无需额外创建新角色，仅需要对2个现有资源的权限策略做配置即可完成需求，是当前场景下复杂度最低、权限边界最清晰的实现方式。

配置步骤 #

1. 账户A侧：为Lambda现有执行角色Role1添加S3访问权限 #

给Role1追加以下权限策略，允许其访问账户B的目标S3桶资源：

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "s3:GetObject",
                "s3:ListBucket"
            ],
            "Resource": [
                "arn:aws:s3:::<账户B的目标桶名>",
                "arn:aws:s3:::<账户B的目标桶名>/*"
            ]
        }
    ]
}

可根据实际业务需求增删Action字段内的S3操作权限

2. 账户B侧：为目标S3存储桶添加桶策略 #

在账户B的目标S3桶的桶策略中，明确授权账户A的Role1访问权限：

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Principal": {
                "AWS": "arn:aws:iam::<账户A的账号ID>:role/Role1"
            },
            "Action": [
                "s3:GetObject",
                "s3:ListBucket"
            ],
            "Resource": [
                "arn:aws:s3:::<账户B的目标桶名>",
                "arn:aws:s3:::<账户B的目标桶名>/*"
            ]
        }
    ]
}

特殊场景补充配置 #

如果账户B的目标S3桶开启了KMS服务端加密，需要额外追加KMS访问权限：

• 账户A的Role1权限策略中添加KMS解密权限，Resource为桶使用的KMS密钥ARN
• 账户B的KMS密钥策略中，添加允许账户A的Role1调用kms:Decrypt操作的授权

CloudFormation配置片段示例 #

账户A侧（修改Role1的配置） #

Resources:
  LambdaExecutionRolePolicy:
    Type: AWS::IAM::Policy
    Properties:
      PolicyName: CrossAccountS3AccessPolicy
      PolicyDocument:
        Version: '2012-10-17'
        Statement:
          - Effect: Allow
            Action:
              - s3:GetObject
              - s3:ListBucket
            Resource:
              - !Sub 'arn:aws:s3:::${TargetBucketName}'
              - !Sub 'arn:aws:s3:::${TargetBucketName}/*'
      Roles:
        - Role1 # 填入已有的Lambda执行角色名

账户B侧（修改S3桶配置） #

Resources:
  TargetS3BucketPolicy:
    Type: AWS::S3::BucketPolicy
    Properties:
      Bucket: !Ref TargetS3Bucket # 填入目标S3桶的逻辑名
      PolicyDocument:
        Version: '2012-10-17'
        Statement:
          - Effect: Allow
            Principal:
              AWS: !Sub 'arn:aws:iam::${AccountAID}:role/Role1'
            Action:
              - s3:GetObject
              - s3:ListBucket
            Resource:
              - !Sub 'arn:aws:s3:::${TargetS3Bucket}'
              - !Sub 'arn:aws:s3:::${TargetS3Bucket}/*'

内容的提问来源于stack exchange，提问作者nebula186