How to assume role which is passed from a aws config Rule in python

Question

I am trying to centrally manage the lambda function for the custom config rule which is running in the child account. The lambda function will assume role which is passed to the config rule as a parameter.

I am following How to Centrally Manage AWS Config Rules across Multiple AWS Accounts | AWS DevOps Blog.

It is mentioned doing this:

// Assume the role passed from the managed-account

aws.config.credentials = new aws.TemporaryCredentials({RoleArn: ruleParameters.executionRole});
let config = new aws.ConfigService({});

How to do in Python?

https://docs.aws.amazon.com/code-samples/latest/catalog/python-sts-assume_role.py.html — error404, Jun 28 '19 at 15:31
thank you but this is not what I am looking for.. I am looking for sts and config together. how to assume a role which is passed in a config rule as a parameter. — RMish, Jun 28 '19 at 15:45
I suspect it will be like assuming the role here: [Assume IAM role and then generate pre-signed URL in Python](https://stackoverflow.com/a/56766798/174777) — John Rotenstein, Jun 28 '19 at 23:11
@JohnRotenstein Yeah I tried that earlier and it worked. Thank you! — RMish, Jul 08 '19 at 20:24

score 1 · Accepted Answer · edited Jul 09 '19 at 00:55

I went through the blog that you have shared and according to the blog, when you create the config rule in the managed account, you have to pass the executionRole as a parameter.

In case you dont know what is the executionRole, it is the role that is created in step 3 in the managed account that can be assumed by the role/lambda_config_role in the admin account.
role/lambda_config_role is the role that you assign to the lambda function in the parent account.

As per the blog:

Create a role A in the admin account.
Create a role B in the managed account.
Add role A as a trusted entity to role B.
Pass Role B as a parameter to the Lambda function while creating the config rule. (this can be done as explained in step 5 of the blog.)
Use the role parameter in your python code in admin account. Since you have allowed role A to assume role B, role A has necessary permissions to create temporary credentials and use them.

How to assume role which is passed from a aws config Rule in python

1 Answers1