does DSS support switch IAM role?

tomas · January 2019

Does DSS support the switch of IAM role, as described here? https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_use_switch-role-api.html

To access an S3 bucket in other account we would need to switch and use a cross account role,

Thanks

Jediv · January 2022

Hi, DSS now supports switching IAM roles for access to S3 connections. The best practice here is to separate out your s3 access policy into a separate role and then set up assumeRole permissions on your connection. In detail:

1. Create a separate role with your s3 access policy. See here for an example of the inline policy. We'll call this role Dataiku-DSS-S3-Access:

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "s3:PutObject",
                "s3:GetObject",
                "s3:DeleteObject",
                "s3:GetEncryptionConfiguration",
                "s3:ListBucketMultipartUploads",
                "s3:AbortMultipartUpload",
                "s3:ListBucket",
                "s3:GetBucketLocation",
                "s3:ListMultipartUploadParts"
            ],
            "Resource": [
                "arn:aws:s3:::dataiku-bucket",
                "arn:aws:s3:::dataiku-bucket/*"
            ]
        }
    ]
}

2. Assuming that your roles are in the same account you can just update the trust policy of your new role to allow your instance profile role to assume it:

{
    "Version": "2012-10-17",
    "Statement": [{
        "Sid": "DSS-S3-AccessTrustPolicy",
        "Effect": "Allow",
        "Action": "sts:AssumeRole",
        "Principal": {
            "AWS": "arn:aws:iam::XXXXXX:role/name-of-your-instance-profile-role"
        }
    }]
}

3. If you're going cross account, you'll need to give assumeRole permissions to your instance profile role as well:

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "iam:GetRole",
                "iam:PassRole",
                "iam:AssumeRole"
            ],
            "Resource": [
                "arn:aws:iam::XXXXXXXXX:role/Dataiku-DSS-S3-Access"
            ]
        }
    ]
}

4. In Dataiku, switch your connection to use this new role: