Assuming IAM Role

Situation

Due to specific security considerations, it is not possible to use an IAM user with appropriate permissions to access S3 using CloudBerry Explorer. An IAM role is required.

Solution

The following setup can be used to enable access to the IAM role while using an IAM user with minimum permissions to authorize in CloudBerry Explorer.

1. Create the IAM user (in this case study, cloudberry_explorer), then attach the following policy to that user:

{
	"Version": "2012-10-17",
	"Statement": [
    	{
        	"Action": [
            	"sts:AssumeRole"
        	],
        	"Resource": [
            	"arn:aws:iam::01234567890:role/iamrole"
        	],
        	"Effect": "Allow",
        	"Sid": "AllowAssumeExplorerRole"
    	}
	]
}

2. Confirm that arn:aws:iam::01234567890:role/iamrole has the appropriate permissions assigned. Below is a minimum set of permissions required to work with a specific bucket:

{
    "Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Action": [
"s3:ListBucket",
"s3:GetBucketLocation",
"s3:ListBucketMultipartUploads"
],
"Resource": "arn:aws:s3:::bucketname",
"Condition": {}
},
{
"Effect": "Allow",
"Action": [
"s3:AbortMultipartUpload",
"s3:DeleteObject",
"s3:DeleteObjectVersion",
"s3:GetObject",
"s3:GetObjectAcl",
"s3:GetObjectVersion",
"s3:GetObjectVersionAcl",
"s3:PutObject",
"s3:PutObjectAcl",
"s3:PutObjectVersionAcl"
],
"Resource": "arn:aws:s3:::bucketname/*",
"Condition": {}
},
{
"Effect": "Allow",
"Action": "s3:ListAllMyBuckets",
"Resource": "*",
"Condition": {}
}
]
}

3. Edit the trust relationship for the IAM role:

{
  "Version": "2012-10-17",
  "Statement": [
	{
  	"Effect": "Allow",
  	"Principal": {
    	"AWS": "arn:aws:iam::123456789012:user/cloudberry_explorer"
  	},
  	"Action": "sts:AssumeRole",
  	"Condition": {
    	"StringEquals": {
      	"sts:ExternalId": "12345"
    	}
  	}
	}
  ]
}

4. Use the secret and access keys of cloudberry_explorer IAM user to add the storage to the CloudBerry Explorer software. Then close the application and open the settings.list file with any editor.
5. In the settings.list file, find the Settings xsi:type="S3Settings" string for your storage account, then add the following lines:

	<AssumedRoleARN>arn:aws:iam::01234567890:role/iamrole</AssumedRoleARN> <AssumedRoleExternalId>12345</AssumedRoleExternalId> 

6. Open CloudBerry Explorer. The storage should be visible.