I verified whether it's possible to switch roles to a different AWS account from Kiro Web [It worked]

Hello, this is Usuda.

Is everyone using Kiro? (greetings

This time, I tried to verify whether it's possible to switch roles to an IAM Role in a different AWS account from the AWS account being used in Kiro Web.

Conclusion

It is possible to switch roles from the IAM Role assigned to Kiro Web to another IAM Role! You can implement this by setting the trust policy of the IAM Role as follows.

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Principal": {
                "AWS": "[ARN of the IAM Role configured in Kiro]"
            },
            "Action": [
                "sts:AssumeRole",
                "sts:SetSourceIdentity",
                "sts:TagSession"
            ]
        }
    ]
}

Overview

In Kiro Web, you can access your AWS environment by configuring an IAM Role.

https://dev.classmethod.jp/articles/kiro-web-sandbox-service-role/

https://dev.classmethod.jp/articles/update-kiro-web-iam-role-trusted-policy/

However, currently this approach only allows you to configure a single IAM Role. Documentation is here.

But we know a way. A way to use multiple IAM Roles from a single IAM Role.

That's right, it's Switch Role (Assume Role)!

So, unable to contain my curiosity, I tried to see if it was possible.

Tried It Out

First, here is the state where an IAM Role is already configured in Kiro Web.

In this state, create an IAM Role in the AWS account you want to switch roles to.

You can choose whatever permissions you like, such as ReadOnly or AdministratorAccess, but the trust policy must contain the following.

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Principal": {
                "AWS": "[ARN of the IAM Role configured in Kiro]"
            },
            "Action": [
                "sts:AssumeRole",
                "sts:SetSourceIdentity",
                "sts:TagSession"
            ]
        }
    ]
}

In a typical switch role, only allowing sts:AssumeRole is often sufficient, but in Kiro Web, SourceIdentity and session tags (transitiveTagKeys) are automatically propagated, so you need to allow all three Actions — sts:SetSourceIdentity and sts:TagSession included — on both the source and destination roles.

Once configured, let's try running it from Kiro Web. Since we have the chance, let's use the iOS version currently in preview. After giving instructions like this…

It succeeded as follows.

Now you can do all sorts of things across multiple AWS accounts together with Kiro!

Steps That Failed

At first, I thought it would work the same way as a normal switch role, so I was testing with only sts:AssumeRole. I'll leave the error messages from that attempt here.

1st Attempt

With only sts:AssumeRole, it said sts:SetSourceIdentity was missing.

An error occurred (AccessDenied) when calling the AssumeRole operation:
User: arn:aws:sts::999999999999:assumed-role/TestRole/d-1234567890.xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx
is not authorized to perform: sts:SetSourceIdentity on resource: arn:aws:iam::888888888888:role/TestRole

2nd Attempt

With sts:AssumeRole and sts:SetSourceIdentity only, it said sts:TagSession was missing.

An error occurred (AccessDenied) when calling the AssumeRole operation:
User: arn:aws:sts::999999999999:assumed-role/TestRole/d-1234567890.xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx
is not authorized to perform: sts:TagSession on resource: arn:aws:iam::888888888888:role/TestRole

Summary

I tried switching roles from Kiro Web to operate using an IAM Role in a different AWS account from the configured IAM Role.

Currently, you cannot configure IAM Roles for multiple AWS accounts, so let's use this method as an alternative to leverage multiple AWS accounts!