Within my aws-cdk application, I am working on setting up a lambda function to assume a specific role and obtain credentials through aws-sts. These credentials need to include a tenant_id tag.
AWS CDK Code:
Role to be assumed:
const pdfUserRole = new Role(this, "PDFTenantUserRole", {
assumedBy: new ServicePrincipal("lambda.amazonaws.com").withSessionTags(),
description: "Role assumed by the pdf service for a user",
});
pdfUserRole.addToPolicy(
new PolicyStatement({
actions: ["sts:TagSession"],
resources: ["*"],
})
);
Lambda Function definition:
this.pdfGeneratorFunction = new LambdaFunctionTypescript(
this,
"Handler",
{
tracing: Tracing.PASS_THROUGH,
entry: getFilePath(import.meta.url, "pdf-generator-function.ts"),
memorySize: 1536,
layers: [],
initialPolicy: [
new PolicyStatement({
resources: [pdfUserRole.roleArn],
actions: ["sts:AssumeRole", "sts:TagSession"],
}),
],
}
);
This role is supposed to be assumed by the lambda function in the handler code:
const sts = new STSClient({});
const getCredentials = async (tenantId: string) => {
return sts.send(
new AssumeRoleCommand({
RoleArn: userRoleArn,
RoleSessionName: "PDFGenerator_" + tenantId,
TransitiveTagKeys: ["tenant_id"],
Tags: [
{
Key: "tenant_id",
Value: tenantId,
},
],
})
);
};
The lambda function is associated with a service role that contains an inline definition from the handler.
I am facing an issue where my lambda function cannot call the AssumeRole:
User: arn:aws:sts::<AWSAccountId>:assumed-role/PDFGeneratorHandlerServiceRole/PDFGeneratorHandler is not authorized to perform: sts:AssumeRole on resource: arn:aws:iam::<AWSAccountId>:role/PDFGeneratorPDFTenantUserRole
I suspect there might be a principal issue since it seems like it is calling as the service role instead of the lambda. I have already tried adding a trust relationship between the function and the role without success.
Update: The credentials generated by the lambda function are intended to be used within a virtual browser, not by the lambda itself.
Update 2: You can find an example link here: https://github.com/aws-samples/multi-tenant-database-isolation-patterns/blob/2000b9ff4630d181421a8761ffea3f7a9039eacf/patterns/3-pool-compute-db-per-tenant-iam-auth/silo-compute-iam.ts#29