Skip to content

Instantly share code, notes, and snippets.

Show Gist options
  • Save prestomation/c61b28e7193d51c16ee6e123fb19c97c to your computer and use it in GitHub Desktop.
Save prestomation/c61b28e7193d51c16ee6e123fb19c97c to your computer and use it in GitHub Desktop.
Enforce tag == session name(Untested)
{
"Version": "2012-10-17",
"Statement": [
{
"Sid": "AllowIamUserAssumeRole",
"Effect": "Allow",
"Action": "sts:AssumeRole",
"Principal": {"AWS": "arn:aws:iam::123456789012:user/external-user"},
"Condition": {
"StringEquals": {
"sts:RoleSessionName": "SomeExternalService",
"aws:PrincipalTag/ExternalService": "${sts:RoleSessionName}",
}
}
},
{
"Sid": "AllowIamUserAssumeRole",
"Effect": "Allow",
"Action": "sts:TagSession",
"Principal": {"AWS": "arn:aws:iam::123456789012:user/external-user"},
"Condition": {
"StringEquals": {
"sts:RoleSessionName": "MyExternalProject",
"aws:RequestTag/ExternalService": "${sts:RoleSessionName}",
},
"ForAllValues:StringEquals": {
"sts:TransitiveTagKeys": [
"ExternalService",
]
}
}
}
]
}
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment