Ditching the Access Key: Implementing IAM Roles Anywhere for Secure Edge and On-Prem Workloads

Source: Dev.to

How IAM Roles Anywhere Works

The service relies on a Public Key Infrastructure (PKI) chain:

• Trust Anchor – You tell AWS which Certificate Authority (CA) to trust.
• Profile – Defines which IAM roles can be assumed and for how long.
• Role – An IAM role with a trust policy that allows the rolesanywhere.amazonaws.com service principal to assume it.

Deploying AWS Resources

Below is a minimal CloudFormation template that creates the required trust anchor, IAM role, and profile. Adjust names, ARNs, and policies to fit your environment.

AWSTemplateFormatVersion: '2010-09-09'
Description: Deploy IAM Roles Anywhere for On‑Premise Workloads

Parameters:
  CACertificateBody:
    Type: String
    Description: The PEM‑encoded public key of your Certificate Authority.

Resources:
  EdgeTrustAnchor:
    Type: AWS::RolesAnywhere::TrustAnchor
    Properties:
      Name: OnPremDataCenterAnchor
      Enabled: true
      Source:
        SourceData:
          X509CertificateData: !Ref CACertificateBody
        SourceType: CERTIFICATE_BUNDLE

  EdgeWorkloadRole:
    Type: AWS::IAM::Role
    Properties:
      RoleName: EdgeBackupRole
      AssumeRolePolicyDocument:
        Version: '2012-10-17'
        Statement:
          - Effect: Allow
            Principal:
              Service: rolesanywhere.amazonaws.com
            Action:
              - sts:AssumeRole
              - sts:TagSession
              - sts:SetSourceIdentity
            Condition:
              StringEquals:
                "aws:PrincipalTag/x509Subject/OU": "DataCenter-Northeast"
      ManagedPolicyArns:
        - arn:aws:iam::aws:policy/AmazonS3FullAccess   # Scope as needed

  EdgeProfile:
    Type: AWS::RolesAnywhere::Profile
    Properties:
      Name: EdgeServerProfile
      DurationSeconds: 3600   # 1‑hour temporary credentials
      Enabled: true
      RoleArns:
        - !GetAtt EdgeWorkloadRole.Arn

Configuring the On‑Premise Server

1. Certificate & Private Key – Obtain a client certificate and private key signed by the CA you uploaded as the trust anchor.
2. AWS Signing Helper – Install the aws_signing_helper binary (provided by AWS).
3. Credential Process – Add a profile to ~/.aws/config that invokes the helper.

[profile edge-workload]
credential_process = /usr/local/bin/aws_signing_helper credential-process \
    --certificate /etc/pki/edge/server.crt \
    --private-key /etc/pki/edge/server.key \
    --trust-anchor-arn arn:aws:rolesanywhere:us-east-1:123456789012:trust-anchor/your-anchor-id \
    --profile-arn arn:aws:rolesanywhere:us-east-1:123456789012:profile/your-profile-id \
    --role-arn arn:aws:iam::123456789012:role/EdgeBackupRole

With this configuration, any application that uses the edge-workload profile automatically receives short‑lived credentials; the application itself never needs to know about IAM Roles Anywhere.

Sample Application Code

import boto3
from botocore.exceptions import ClientError

def upload_to_s3(file_name: str, bucket: str) -> None:
    """Upload a file to S3 using the edge‑workload profile."""
    session = boto3.Session(profile_name='edge-workload')
    s3 = session.client('s3')

    try:
        s3.upload_file(file_name, bucket, file_name)
        print(f"Successfully uploaded {file_name} using temporary credentials!")
    except ClientError as e:
        print(f"Upload failed: {e}")

if __name__ == "__main__":
    upload_to_s3('daily_backup.tar.gz', 'my-secure-onprem-backups')

Benefits

• Zero Static Secrets – If the edge server is compromised, no AWS keys reside on disk.
• Instant Revocation – Revoking the client certificate at your CA immediately blocks access without any IAM changes.
• Auditability – Each credential request is logged in CloudTrail, including the certificate’s serial number.
• Zero‑Trust Alignment – Short‑lived, automatically rotated credentials fit modern security best practices.

Transitioning to IAM Roles Anywhere is a hallmark of a mature AWS architecture, bridging the gap between on‑premise stability and cloud‑native security.