Allow selected IAM users to switch role

问题

I have two AWS accounts(Account A & B). I want to allow few IAM users of Account B to access resources of Account A via AWS IAM roles.

I have created the role and it works fine. However, I see that any IAM user who gets hold of the role name is able to switch roles and access the resources.

Is there a way to allow only specific users of Account B to be able to switch to the role?

The trust policy statement is as follows-

 {
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": {
        "AWS": "arn:aws:iam::Account-B:root"
      },
      "Action": "sts:AssumeRole"
    }
  ]
}

回答1:

You can add the users who should be restricted to assume the role to a group. Then you can attach IAM policy to the IAM group with an explicit Deny.

{
  "Version": "2012-10-17",
  "Statement": {
    "Effect": "Deny",
    "Action": "sts:AssumeRole",
    "Resource": "arn:aws:iam::Account_A_ID:role/Rolename"
  }
}

http://docs.aws.amazon.com/IAM/latest/UserGuide/tutorial_cross-account-with-roles.html#tutorial_cross-account-with-roles.html#tutorial_cross-account-with-roles-2

来源：https://stackoverflow.com/questions/42644592/allow-selected-iam-users-to-switch-role