2

Instead of allowing individual dbuser user, how can I allow Redshift dbgroup to allow accessing other AWS resource?

Explanation:

Currently, we have a role that allows Redshift Spectrum to query data in our S3 buckets. Also, we have a dbuser say alice and alice is also a part of a dbgroup say foobar. To allow alice to query the data, Trust relationship defined in our role looks something like;

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": {
        "Service": "redshift.amazonaws.com"
      },
      "Action": "sts:AssumeRole",
      "Condition": {
        "StringEquals": {
          "sts:ExternalId": [
            "arn:aws:redshift:us-XXXX-X:XXXXXXXXXXXX:dbuser:cluster-1a/alice"
          ]
        }
      }
    } 

Everything works fine as we keep adding more users to the condition shown above. For example:

"sts:ExternalId": [
                "arn:aws:redshift:us-XXXX-X:XXXXXXXXXXXX:dbuser:cluster-1a/alice",
                "arn:aws:redshift:us-XXXX-X:XXXXXXXXXXXX:dbuser:cluster-1a/bob"
              ]

Since both alice and bob are part of dbgroup called foobar, how can I allow foobar group to assume the role instead of allowing individual users.

I want something like;

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": {
        "Service": "redshift.amazonaws.com"
      },
      "Action": "sts:AssumeRole",
      "Condition": {
        "StringEquals": {
          "sts:ExternalId": [
            "arn:aws:redshift:us-XXXX-X:XXXXXXXXXXXX:dbgroup:cluster-1a/foobar"
          ]
        }
      }
    } 

P.S. dbuser: Cluster database user, dbgroup: Cluster database user group

Myz
  • 818
  • 1
  • 8
  • 21

0 Answers0