(AWS) IAM Console access

[devsheva]

I firstly got a pair of access ID/access key to be able to programmatically call AWS API from a customer. Now they enabled me console access so i got a pair of username-password. My question is, how can i configure leapp in order to be able to access web console from the app?

[ericvilla]

Hi @devsheva, unfortunately it's not possible to "Open Web Console" as for role-based sessions.
My suggestion is to create an IAM Role that is assumable by the IAM User you're using to access the console.
Then, from Leapp, you can create both the IAM User and IAM Role Chained sessions; the IAM Role Chained one should have the IAM User as its parent session.
Let me know if it fits your use case

[devsheva]

Hi, I guess that my user has actually an attached role. I’d need to retrieve the arn of the role i presume to achieve my goal right?

[ericvilla]

Hello @devsheva, are you using AWS SSO (Identity Center) or an IAM User to access your account?

[devsheva]

IAM User

[ericvilla]

Ok, then I would follow these steps:

• create an IAM Role (in the same account of the IAM User) with an access policy that contains the permissions you expect to have to operate in the AWS Console;
• modify the IAM Role trust relationship to make the role assumable by the existing IAM User;
• (inside Leapp) create an IAM User session that corresponds to the existing IAM User;
• (inside Leapp) create an IAM Role session that uses the IAM User session as its parent;
• (inside Leapp) right-click the IAM Role session and - in the contextual menu - click "Open Web Console"

Let me know if it works.

Cheers

[devsheva]

I appreciate the help, but I guess I won't be able to do it. As I specified, the user was given to me from a customer. I don't have the right permissions to create a Role, so i think this question sadly ends here