Create IAM Roles

1. Create a trust policy document. Trust policy documents are JSON files that grant an entity permission to assume a role.

   Example for a Web Identity user

   The following JSON file defines a trust policy assumable by any Web Identity user from the readOnly group in the ARTESCA Identity Provider:

   {
       "Version": "2012-10-17",
       "Statement": [
          {
              "Effect": "Allow",
              "Principal": { "Federated": "https://ui.<base-domain-name>/auth/realms/artesca" },
              "Action": "sts:AssumeRoleWithWebIdentity",
              "Condition": {
                  "StringEquals": { "keycloak:groups": "readOnlyRole" }
              }
          }
      ]
   }
   

   Note

   • Replace <base-domain-name> with your ARTESCA subdomain.

   • The trust policy condition keycloak:groups can be used to restrict access to an IAM role for Web Identity users belonging to a specific group. Add the account prefix (for example accountTest::readOnlyRole) to the trust policy file. This can be useful if multiple IAM roles share the same names across multiple accounts.

   • This is the kind of role that must be used in order to map a ARTESCA Web Identity user or Group to an IAM role in ARTESCA UI identity tab.

   Example for an IAM user

   The following JSON file defines a trust policy assumable by any IAM user from the account:

   {
       "Version": "2012-10-17",
       "Statement": [
          {
              "Effect": "Allow",
              "Principal": "*",
              "Action": "sts:AssumeRole"
          }
      ]
   }
   

   Create and save a JSON file that defines the trust policy. You may choose any name for the trust policy filename. This file will be used in the creation of the IAM role in the next step.

2. Create the IAM Role using the AWS CLI.

   In the following example, the trust policy file used is named trustPolicy.json, which was created in the previous step.

   aws --endpoint-url https://iam.<base-domain-name> iam create-role  --role-name readOnlyRole --assume-role-policy-document file://trustPolicy.json
   

   {
      "User": {
         "UserName": "devops",
         "Path": "/",
         "UserId": "1A4BZ7OTEXL9LST4DQ1XXC15J1QQYLQ6",
         "Arn": "arn:aws:iam::823610900596:user/devops"
      }
   }
   

Note

The role is now created but has no permissions to the S3 service. To define what services the role can access, attach a policy to the role.