Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Add info on cross-account/region VPC peering #829

Merged
merged 3 commits into from
Sep 28, 2023
Merged

Add info on cross-account/region VPC peering #829

Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
48fbd5f
Add section on cross-account VPC peering
viren-nadkarni Sep 19, 2023
5205b59
Update note on IAM enforcement
viren-nadkarni Sep 20, 2023
0d415b5
Include TGW peering attachments
viren-nadkarni Sep 28, 2023
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
68 changes: 37 additions & 31 deletions content/en/references/cross-account-access.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -23,10 +23,36 @@ Resources that can be accessed across multiple accounts are always identified by
The full list of resources and operations that allow cross-account access are listed below.

{{< alert title="Note">}}
IAM currently does not enforce cross-account access.
Any ACLs, identity-based or resource-based policy attached to these operations or resources will be ignored.
LocalStack does not enforce IAM for cross-account access by default.
Use the `ENFORCE_IAM` [configuration]({{< ref "configuration#iam" >}}) option to enable it.
{{< /alert >}}

### EC2 Peering

It is possible to create peered VPCs and transit gateway peering attachments that are in a different region or account than the requester.
Ensure that the `PeerRegion` and `PeerOwnerId` arguments are correctly set when creating these resources.

### KMS keys

- `CreateGrant`
- `Decrypt`
- `DescribeKey`
- `Encrypt`
- `GenerateDataKey`
- `GenerateDataKeyPair`
- `GenerateDataKeyPairWithoutPlaintext`
- `GenerateDataKeyWithoutPlaintext`
- `GenerateMac`
- `GetKeyRotationStatus`
- `GetPublicKey`
- `ListGrants`
- `RetireGrant`
- `RevokeGrant`
- `Sign`
- `Verify`
- `VerifyMac`
<!-- - ReEncrypt (NOT IMPLEMENTED IN LOCALSTACK) -->

### Lambda functions and layers

- `AddLayerVersionPermission`
Expand Down Expand Up @@ -55,32 +81,15 @@ Any ACLs, identity-based or resource-based policy attached to these operations o
- `UpdateAlias`
- `UpdateFunctionCode`

### SQS queues

On AWS, all operations except `AddPermission`, `CreateQueue`, `DeleteQueue`, `ListQueues`, `ListQueueTags`, `RemovePermission`, `SetQueueAttributes`, `TagQueue` and `UntagQueue` allow cross-account access.
### S3 buckets

On LocalStack, all operations allow cross-account access.
Like AWS, LocalStack S3 has a bucket namespace which is shared by all accounts.
This means that the bucket name has to be globally unique.

### KMS keys
- `GetObject`
- `ListObjects`
- `PutObject`

- `CreateGrant`
- `Decrypt`
- `DescribeKey`
- `Encrypt`
- `GenerateDataKey`
- `GenerateDataKeyPair`
- `GenerateDataKeyPairWithoutPlaintext`
- `GenerateDataKeyWithoutPlaintext`
- `GenerateMac`
- `GetKeyRotationStatus`
- `GetPublicKey`
- `ListGrants`
- `RetireGrant`
- `RevokeGrant`
- `Sign`
- `Verify`
- `VerifyMac`
<!-- - ReEncrypt (NOT IMPLEMENTED IN LOCALSTACK) -->

### SNS topics

Expand All @@ -93,14 +102,11 @@ On LocalStack, all operations allow cross-account access.
- `SetTopicAttributes`
- `Subscribe`

### S3 buckets
### SQS queues

Like AWS, LocalStack S3 has a bucket namespace which is shared by all accounts.
This means that the bucket name has to be globally unique.
On AWS, all operations except `AddPermission`, `CreateQueue`, `DeleteQueue`, `ListQueues`, `ListQueueTags`, `RemovePermission`, `SetQueueAttributes`, `TagQueue` and `UntagQueue` allow cross-account access.

- `GetObject`
- `ListObjects`
- `PutObject`
On LocalStack, all operations allow cross-account access.

## Cross-Region

Expand Down