Lesson 12 — Cross-Account Access

Learning Path

☁️ Phase 2 – AWS Cloud Security

📘 Module 02 – Identity & Access Management (IAM)

---

🎯 Lesson Objective

By the end of this lesson, you will be able to:

• Understand AWS Cross-Account Access.
• Explain why enterprises use multiple AWS accounts.
• Configure IAM Roles for Cross-Account Access.
• Understand Trust Relationships between AWS accounts.
• Use AWS STS AssumeRole for secure access.
• Apply Cross-Account security best practices.
• Troubleshoot Cross-Account access issues.

---

📚 Lesson Information

Estimated Time: 4 Hours

Difficulty: Intermediate

Prerequisites: Lesson 11 – AWS Security Token Service (STS) & Temporary Credentials

Hands-on Lab: Yes

Assignment: Yes

---

💼 Business Value

As organisations grow, they rarely operate from a single AWS account.

Instead, they separate workloads into multiple AWS accounts for better security, governance and cost management.

Typical enterprise AWS environments include:

• Management Account
• Development Account
• Testing Account
• Production Account
• Security Account
• Shared Services Account
• Disaster Recovery Account

Users often need access to resources across multiple accounts.

Rather than creating separate IAM Users in every account, AWS recommends using Cross-Account Access with IAM Roles and AWS STS.

---

🏢 In the Company

CloudNova Technologies has expanded globally.

The AWS Organization now contains:

• Management Account
• Development Account
• Testing Account
• Production Account
• Security Account
• Shared Services Account

Security Engineers frequently investigate incidents in every account.

Previously, separate IAM Users existed in each AWS account.

Problems included:

• Password management
• Inconsistent permissions
• Difficult auditing
• Increased attack surface

The CISO decides to replace local IAM Users with Cross-Account IAM Roles.

---

🌍 What is Cross-Account Access?

Cross-Account Access allows an IAM User or IAM Role in one AWS account to securely access resources in another AWS account.

Instead of creating duplicate identities, AWS issues temporary credentials through AWS STS.

This approach simplifies administration while improving security.

---

🏗 Multi-Account Architecture

CloudNova AWS Organization

             │

 ┌───────────┼────────────┐
 │           │            │
 ▼           ▼            ▼

Development  Testing   Production

        │

        ▼

Security Account

        │

        ▼

Cross-Account IAM Role

        │

        ▼

Temporary Credentials

        │

        ▼

Secure Access

---

🔑 Why Use Cross-Account Access?

Cross-Account Access provides several advantages.

• Centralized identity management
• Reduced number of IAM Users
• Better auditing
• Temporary credentials
• Least Privilege
• Easier administration
• Improved security

---

🔐 Components of Cross-Account Access

A Cross-Account solution typically consists of:

• Source AWS Account
• Target AWS Account
• IAM Role
• Trust Policy
• IAM Permissions Policy
• AWS STS AssumeRole

Each component plays an important role in secure authentication.

---

🏢 Enterprise Example

CloudNova Security Engineers work from the Security Account.

When an incident occurs in the Production Account, engineers assume the following role:

Production-IncidentResponse-Role

AWS STS issues temporary credentials.

The engineer investigates the incident and, once the session expires, access is automatically removed.

No permanent Production account credentials are required.

---

🔄 Cross-Account Authentication Flow

Security Engineer

        │

Security Account

        │

AssumeRole

        │

AWS STS

        │

Temporary Credentials

        │

Production Account

        │

Investigate Incident

---

🤝 Trust Relationships

A Trust Policy specifies who is allowed to assume an IAM Role.

Example:

Development Account

↓

Allowed to Assume

↓

Production-ReadOnly-Role

Without a Trust Policy, AWS denies the request.

---

📜 Example Trust Policy

{
  "Version":"2012-10-17",
  "Statement":[
    {
      "Effect":"Allow",
      "Principal":{
        "AWS":"arn:aws:iam::111122223333:root"
      },
      "Action":"sts:AssumeRole"
    }
  ]
}

This policy allows the specified AWS account to assume the role.

---

🛡 Security Benefits

Cross-Account Access provides:

• No shared passwords
• No duplicated IAM Users
• Temporary credentials
• CloudTrail auditing
• Better governance
• Reduced credential exposure
• Easier compliance

---

🚫 Common Mistakes

Avoid:

❌ Creating IAM Users in every AWS account.

❌ Sharing AWS credentials.

❌ Granting AdministratorAccess unnecessarily.

❌ Using overly permissive Trust Policies.

❌ Forgetting to monitor AssumeRole activity.

---

✅ Enterprise Best Practices

• Use AWS Organizations.
• Use IAM Identity Center for workforce identities.
• Use IAM Roles for Cross-Account Access.
• Require MFA for privileged roles.
• Enable CloudTrail in every account.
• Review Trust Policies regularly.
• Follow the Principle of Least Privilege.

---

🧪 Enterprise Mission 01 — Review AWS Organization

Navigate to:

AWS Organizations

↓

Accounts

Review:

• Management Account
• Member Accounts
• Organizational Structure

Document your observations.

---

🧪 Enterprise Mission 02 — Review Existing Cross-Account Roles

Navigate to:

IAM

↓

Roles

Identify Roles used for:

• Cross-Account Administration
• Security Auditing
• Read-Only Access

Review:

• Trust Policy
• Attached Permissions

---

🧪 Enterprise Mission 03 — Create a Cross-Account Trust Policy

Create a file named:

CrossAccountTrust.json

Example:

{
  "Version":"2012-10-17",
  "Statement":[
    {
      "Effect":"Allow",
      "Principal":{
        "AWS":"arn:aws:iam::111122223333:root"
      },
      "Action":"sts:AssumeRole"
    }
  ]
}

Save the file.

---

🧪 Enterprise Mission 04 — Create a Cross-Account IAM Role

Run:

aws iam create-role \
--role-name ProductionReadOnlyRole \
--assume-role-policy-document file://CrossAccountTrust.json

Verify:

aws iam get-role \
--role-name ProductionReadOnlyRole

---

🧪 Enterprise Mission 05 — Attach Read-Only Permissions

Attach an AWS Managed Policy.

aws iam attach-role-policy \
--role-name ProductionReadOnlyRole \
--policy-arn arn:aws:iam::aws:policy/ReadOnlyAccess

Verify.

aws iam list-attached-role-policies \
--role-name ProductionReadOnlyRole

---

🧪 Enterprise Mission 06 — Assume the Cross-Account Role

Run:

aws sts assume-role \
--role-arn arn:aws:iam::TARGET_ACCOUNT_ID:role/ProductionReadOnlyRole \
--role-session-name CloudNovaCrossAccount

Review:

• AccessKeyId
• SecretAccessKey
• SessionToken
• Expiration

---

🧪 Enterprise Mission 07 — Review CloudTrail Events

Navigate to:

CloudTrail

↓

Event History

Filter for:

AssumeRole

Review:

• Source Account
• Target Account
• User
• Event Time
• Source IP

---

🧪 Enterprise Mission 08 — Enterprise Design Exercise

CloudNova has:

• 15 AWS Accounts
• 200 Developers
• 40 Security Engineers
• 25 DevOps Engineers

Design a Cross-Account Access strategy.

Include:

• Administrative access
• Read-only access
• Incident response
• Audit access
• Logging
• MFA requirements

---

🏢 Enterprise Scenario

CloudNova acquires another company.

The acquired company already has:

• Five AWS Accounts
• Existing IAM Users
• Separate administrators

Management requires:

• Centralized authentication.
• No duplicated IAM Users.
• Temporary credentials.
• Secure administration across all AWS accounts.

Design a migration strategy using:

• AWS Organizations
• IAM Identity Center
• IAM Roles
• AWS STS
• Cross-Account Access

---

📊 Knowledge Check

1. What is AWS Cross-Account Access?

2. Why do enterprises use multiple AWS accounts?

3. What is the purpose of a Trust Policy?

4. Which AWS service issues temporary credentials?

5. What is AssumeRole?

6. Why are IAM Roles preferred over IAM Users?

7. Why should Cross-Account access use temporary credentials?

8. Which AWS service records AssumeRole events?

9. What are the benefits of AWS Organizations?

10. How does Cross-Account Access improve enterprise security?

---

📝 Assignment

Prepare an AWS Cross-Account Access Implementation Guide.

Include:

• Multi-Account Architecture
• IAM Roles
• Trust Policies
• AssumeRole
• AWS STS
• Enterprise Security Benefits
• AWS CLI Commands Used
• CloudTrail Monitoring
• Lessons Learned

Length: 5–6 Pages

---

📋 Lesson Completion Checklist

Task	Status
Reviewed AWS Organization	☐
Reviewed Cross-Account Roles	☐
Created Trust Policy	☐
Created IAM Role	☐
Attached Permissions	☐
Assumed Cross-Account Role	☐
Reviewed CloudTrail Events	☐
Completed Enterprise Design	☐
Completed Assignment	☐

---

💡 Key Takeaways

After completing this lesson, you should understand:

• Cross-Account Access enables secure access between AWS accounts without creating duplicate IAM Users.
• IAM Roles and AWS STS provide temporary credentials that reduce security risks associated with long-term credentials.
• Trust Policies determine which accounts or identities can assume Cross-Account Roles.
• CloudTrail provides complete visibility into Cross-Account authentication and role assumption activities.
• Cross-Account Access is a foundational capability for secure, scalable multi-account AWS enterprise environments.

---

📚 Further Reading

• AWS Cross-Account Access Documentation
• AWS IAM Roles User Guide
• AWS Security Token Service (STS) User Guide
• AWS Organizations Documentation
• AWS Well-Architected Framework – Security Pillar

---

🚀 Next Lesson

➡️ Lesson 13 — IAM Access Analyzer