The repository contains Terraform configuration files for provisioning AWS infrastructure to implement S3 bucket cross-account access. Terraform AWS provider is utilized to provision AWS resources.
There is an AWS account where a private S3 bucket is created. There is a bucket policy defined, allowing accessing the bucket to a role, located in the second AWS account. There is an EC2 instance in the second AWS account. The instance has an instance profile assigned, which the role is attached to. The instance is located in a private subnet and uses a NAT Gateway to access AWS S3 and SSM services by public URLs. There is an SSM-agent running on the instance, which registers it with AWS System Manager.
Described architecture is shown on the diagram.
- Change working directory to terraform and install the required Terraform providers:
cd terraform terraform init
- Make sure that your local
default
AWS profile has permissions to read/write the S3 bucket to store the Terraform's state. Change the bucket name to match the one from your AWS account; - Make sure there are two AWS profiles, corresponding two different AWS accounts, declared in local
~/.aws/credentials
file. Adjust profile variables to match your existing AWS profiles:
aws_profile_1
- an AWS account where S3 bucket will be created;
aws_profile_2
- an AWS account to access the S3 bucket from. - Adjust infrastructure configuration, changing variables values (if the default values don't suit);
- Run the following command to provision the AWS resources:
terraform apply
The EC2 instance created in private subnet and its security group doesn't have any inbound rules. So, all the ports are
closed for incoming connections. SSH access can be setup with AWS Systems Manager -> Session Manager
. Just start a new
session and choose the instance as a target.
Connect to the instance with SSH and use AWS CLI to access the bucket. The following actions are permitted to execute on the bucket by the security policy :
- List files;
- Download a file;
- Upload a file;
- Remove a file.
Here is some examples of the useful commands:
- List all the files within the bucket:
where:
aws s3 ls s3://<bucket>
<bucket>
- the name of the bucket - Upload
simple-text.txt
file to the bucket and grant the bucket's owner full control over the file:where:aws s3 cp simple-text.txt s3://<bucket> --acl bucket-owner-full-control
<bucket>
- the name of the bucket
- Change working directory to terraform and remove all the resources Terraform created:
If the bucket, Terraform previously created, isn't empty, you will get the corresponding error. Terraform is not going to remove a non-empty bucket. Just empty the bucket manually in AWS Console or with AWS CLI command first, and then run the destroy command again.
cd terraform terraform destroy