<p>It would be better to use the official docs as trusted source :)
<a href="https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_create_for-user.html" rel="nofollow noreferrer">AWS Official Docs</a></p>

CC BY-SA 4.0
2020-06-30T20:29:57.100Z
What do you mean?
Preston Martin
CC BY-SA 4.0
2020-06-30T20:42:00.937Z
Create role with trusted relations to the users which must have temporarily permissions to the services you want. STS token typically lives 3 hours by default, but you can manage it
Hakob
CC BY-SA 4.0
2020-06-30T19:31:54.970Z
2020-06-30T19:31:54.970Z
Hakob
<ol>
<li>Create an IAM role in prod with all the permissions you'd like the devs to have.</li>
<li>When you want devs to have prod access, add the <code>sts:AssumeRole</code> permission to their IAM group.</li>
<li>When it's time to revoke access, remove the <code>sts:AssumeRole</code> permission.</li>
</ol>
<p>More details in my blog article <a href="https://harishkm.in/2020/06/28/grant-temporary-access-to-an-iam-user-or-group-to-another-aws-account/" rel="nofollow noreferrer">here</a>.</p>

CC BY-SA 4.0
2020-06-29T00:15:14.993Z
Sorry Harish, I accidentally put SSM instead of STS in my question. I've corrected the question. What I'm looking for is a simpler managed solution rather than using the native STS functionality that AWS offers. The solution could use STS in the backend, but I'm looking for something that would require less management of the role structures. Ideally, something that could be quickly implemented by either a manager or lead could activate when a system outage occurs. I've added an example for clarification.
Preston Martin
CC BY-SA 4.0
2020-06-28T15:13:57.097Z
2020-06-28T17:05:26.593Z
2020-06-28T17:05:26.593Z
Harish KM
<p>I'm looking for a service or third party solution that allows for granting temporary access to an IAM user (or group) to one or more services in an AWS account.</p>
<p>The example I have is there is an outage in a production account, and I would like to grant temporary access to developers/sys admins to resolve the issue. Under normal circumstances, they would not have access to this particular service/account.</p>
<p>Ideally, I would like this to me a managed off the shelf solution vs something like STS, which would require quite a bit of configuration. Example, a system outage occurs for unknown reasons in a production account that the on call SRE does not normally have access to. A manager or lead should quickly be able to temporarily escalate privileges for the user until the &quot;firefight&quot; is resolved.</p>

CC BY-SA 4.0
2020-06-23T21:54:35.693Z
Just to clarify, these developers and sysadmins already have either (a) an IAM User in the same AWS account, but with limited access, or (b) an IAM User in a different AWS account, correct?

Also, do you have any existing products with an employee directory? G Suite or Active Directory, for example? This may help identify a third-party tool to integrate with.
Woodland
CC BY-SA 4.0
2020-06-25T04:20:31.517Z
A or B can be assumed, it doesn't matter. I would like to stick to limiting it to within the AWS ecosystem.
Preston Martin
<amazon-web-services><aws-iam><sysadmin>
AWS Temporary Permission Granting Tool for Account/Service "Firefights"
Preston Martin
# AWS Temporary Permission Granting Tool for Account/Service "Firefights"

(Asked by: username_0 on 2020-06-23)

I'm looking for a service or third party solution that allows for granting temporary access to an IAM user (or group) to one or more services in an AWS account.

The example I have is there is an outage in a production account, and I would like to grant temporary access to developers/sys admins to resolve the issue. Under normal circumstances, they would not have access to this particular service/account.

Ideally, I would like this to me a managed off the shelf solution vs something like STS, which would require quite a bit of configuration. Example, a system outage occurs for unknown reasons in a production account that the on call SRE does not normally have access to. A manager or lead should quickly be able to temporarily escalate privileges for the user until the "firefight" is resolved.

**Tags:** amazon-web-services, aws-iam, sysadmin

> **Comments:**
> **username_1**: Just to clarify, these developers and sysadmins already have either (a) an IAM User in the same AWS account, but with limited access, or (b) an IAM User in a different AWS account, correct?  Also, do you have any existing products with an employee directory? G Suite or Active Directory, for example? This may help identify a third-party tool to integrate with.  
> **username_0**: A or B can be assumed, it doesn't matter. I would like to stick to limiting it to within the AWS ecosystem.  

---

## 2 answers

### Answer by username_3 on 2020-06-28. Score: 1

1. Create an IAM role in prod with all the permissions you'd like the devs to have.
2. When you want devs to have prod access, add the `sts:AssumeRole` permission to their IAM group.
3. When it's time to revoke access, remove the `sts:AssumeRole` permission.

More details in my blog article [here](https://harishkm.in/2020/06/28/grant-temporary-access-to-an-iam-user-or-group-to-another-aws-account/).

> **Comments:**
> **username_0**: Sorry Harish, I accidentally put SSM instead of STS in my question. I've corrected the question. What I'm looking for is a simpler managed solution rather than using the native STS functionality that AWS offers. The solution could use STS in the backend, but I'm looking for something that would require less management of the role structures. Ideally, something that could be quickly implemented by either a manager or lead could activate when a system outage occurs. I've added an example for clarification.  

---

### Answer by username_2 on 2020-06-30. Score: 0

It would be better to use the official docs as trusted source :)
[AWS Official Docs](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_create_for-user.html)

> **Comments:**
> **username_0**: What do you mean?  
> **username_2**: Create role with trusted relations to the users which must have temporarily permissions to the services you want. STS token typically lives 3 hours by default, but you can manage it  

---

