# Understanding AWS Cross-Account Roles: A Practical Example

AWS Roles provide a way to assign necessary permissions to a role, which can then be assumed by any identity. The key benefit of using roles is that they use the permissions associated with the assigned role, rather than the permissions of the user or service assuming the role. In this article, we will explore how a cross-account role works, specifically for accessing an S3 bucket in a different AWS account.

### Scenario Overview

For this demonstration, we are using two AWS accounts:

* **Account 1**: This account needs access to an S3 bucket in Account 2.
    
* **Account 2**: This account hosts the S3 bucket that Account 1 needs to access.
    

### Steps to Set Up Cross-Account Role Access

#### 1\. Create a User in Account 1

In **Account 1**, I created a user named “mycrossaccountuser” (user ID: 3xxxxxx91). This user only has one policy attached: `sts:AssumeRole` on the role in **Account 2** (role ID: 2xxxx34). Aside from this, the user has no other privileges in Account 1.

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1742885691106/47354eb2-211f-4568-9558-150724cd8fad.png align="center")

#### 2\. Create a Role in Account 2

In **Account 2**, I created a role called “myfirstcrossaccountrole” that has **S3 Full Access** permissions. This role is designed specifically for cross-account access, granting the necessary permissions for interacting with S3.

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1742886124253/d4ff50d4-537e-45d4-bd64-1518b72664b3.png align="center")

#### 3\. Set Trust Relationship for the Role in Account 2

To allow the user from **Account 1** to assume this role, a trust relationship must be established. The trust relationship for the role in **Account 2** is configured as follows:

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1742886279173/4f07ac21-df5c-4ff7-bdeb-c0606413e07a.png align="center")

#### 4\. Create an S3 Bucket in Account 2

In **Account 2**, I created an S3 bucket named **kunalcrossaccounttestbucket**. This is where I will be uploading files from **Account 1**.

#### 5\. Accessing the Role in the AWS Console

To switch to the cross-account role from the AWS Console:

1. Log in to **Account 1** as the user “mycrossaccountuser.”
    
2. In the AWS Console, you will find an option to switch roles. Provide the required information, such as the role ARN from **Account 2**, to assume the “myfirstcrossaccountrole” role.
    

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1742886612389/94e26d36-b2db-40d1-bd8a-3bdbb4d1fdb7.png align="center")

Files Being uploaded from Console

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1742886787282/a7c71ec8-901d-4241-bc0c-b2c87512177d.png align="center")

File Uploaded

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1742886875566/83b985bb-9049-4f7a-8d48-75d114e6aa6a.png align="center")

#### 6\. Accessing the Role via AWS CLI

To use the role programmatically, you can configure your AWS CLI with the following steps:

1. **Configure the User’s Access Keys**: Set up the access key for the “mycrossaccountuser” in your CLI profile. I’ve named this profile “crossaccount.”
    
2. **Create a New Profile for Role Access**: To assume the role from **Account 2**, create a new profile in your `.aws/config` file with the role ARN from **Account 2**. Below is the configuration I added to the file:
    

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1742887013232/f2ee7453-7bfd-4a68-87ad-516c29c3de0f.png align="center")

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1742890336627/1aa69ea8-4d41-45c6-8a12-c4414cd0bf4f.png align="center")

#### 7\. Uploading Files to the S3 Bucket

Once the role is assumed, you can upload files from **Account 1** to the S3 bucket in **Account 2**. Use the `aws s3 cp` command to copy files, as shown below:

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1742887333339/8d22a29c-37c0-40dc-8200-e634a29e94be.png align="center")

### Conclusion

This article demonstrates how to set up and use cross-account roles in AWS for S3 access. By leveraging the trust relationship and role-based permissions, you can securely share resources across AWS accounts. Whether you’re managing access between teams or automating tasks across accounts, understanding cross-account roles is essential for efficient and secure cloud operations.