1

I am trying to connect boxfuse to my aws account i am getting the below. Any help is highly appreciated

`Role with ARN arn:aws:iam::535880694150:role/Boxfuse-access has not been properly configured. Please check your configuration and try again. (AWSSecurityTokenService: AccessDenied -> User: arn:aws:iam::762186188748:user/boxfuse-console is not authorized to perform: sts:AssumeRole on resource: arn:aws:iam::535880694150:role/Boxfuse-access)`

I followed the instructions as provided by Boxfuse, Am i missing something, Do i need to do anything special.I used the policy provide by boxfuse

{"Version": "2012-10-17","Statement":[ {"Sid":"allow","Effect":"Allow","Resource":["*"], "Action":["ec2:*","elasticloadbalancing:*","autoscaling:*","rds:*","cloudwatch:*","iam:ListInstanceProfiles","iam:PassRole"]}, {"Sid":"ec2Deny","Effect":"Deny", "Action":["ec2:*"],"Resource":["*"],"Condition":{"StringEquals":{"ec2:ResourceTag/boxfuse:ignore":"true"}}}, {"Sid":"rdsDeny","Effect":"Deny", "Action":["rds:*"],"Resource":["*"],"Condition":{"StringEquals":{"rds:db-tag/boxfuse:ignore":"true"}}}]}

This is how my trust relationship in Iam role policy looks like

{ "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Principal": { "AWS": "arn:aws:iam::762186188748:root" }, "Action": "sts:AssumeRole", "Condition": { "StringEquals": { "sts:ExternalId": "uxvmGXwfII4944dh" }, "Bool": { "aws:MultiFactorAuthPresent": "true" } } } ] }

Viiveek Sankar
  • 63
  • 1
  • 2
  • 6

1 Answers1

1

As stated in the instructions, multi-factor access should be turned off. In your case this can be fixed by updating the policy document to:

{ "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Principal": { "AWS": "arn:aws:iam::762186188748:root" }, "Action": "sts:AssumeRole", "Condition": { "StringEquals": { "sts:ExternalId": "uxvmGXwfII4944dh" } } } ] }

Axel Fontaine
  • 34,542
  • 16
  • 106
  • 137
  • In my case, I also mistakenly created it with multi-factor access turned on. Then I switched it off, to correct the issue, and it still didn't work. When I completely removed the setting (as shown above), it worked perfectly. So don't leave it there set to false, remove it completely by editing the JSON... and that should solve your issue. – fergal_dd Jul 11 '18 at 07:01