Cloudera Docs

Applying the conflicting action conditions to AssumeRole requests using the API

Learn how to generate temporary AWS Security Token Service (STS) credentials using an inline session policy that conflicts with the underlying Ranger policy restrictions. Use this procedure to verify that conflicting session policy actions result in access denial due to a lack of permission overlap.

  1. Open a terminal on your device.
  2. To invoke the assume-role API with a session policy specifying an action (for example, s3:GetObjectTagging) that conflicts with your target role's configured Ranger policy (for example, GetObject and PutObject), run the following assume-role command in the Cloudera Manager Host 1 where you configured AWS: 
    aws sts assume-role \
  --role-arn arn:aws:iam::[***ACCOUNT_ID***]:role/[***ROLE_NAME***] \
  --role-session-name "[***SESSION_NAME***]" \
 --policy '{
    "Version": "2012-10-17",
    "Statement": [
      {
        "Effect": "Allow",
        "Action": "s3:GetObjectTagging",
        "Resource": "arn:aws:s3:::[***BUCKET_NAME***]/*"
      }
    ]
  }' \
  --duration-seconds 3600 \
  --endpoint-url "https://[***OZONE_HOST***]:[***OZONE_PORT***]"
    where,
    • [***ACCOUNT_ID***] is a dummy ID that must match the valid length of an AWS account ID.
    • [***ROLE_NAME***] must be the same role that was created in Ranger.
    • [***SESSION_NAME***] is a dummy name that must match the valid length as per AWS specifications.
    • [***BUCKET_NAME***] must be the bucket name that was created in Ranger.

    Example,

    aws sts assume-role \
  --role-arn "arn:aws:iam::123456789012:role/iceberg-data-all-access" \
  --role-session-name "iceberg-session-with-policy" \
  --policy '{
    "Version": "2012-10-17",
    "Statement": [
      {
        "Effect": "Allow",
        "Action": "s3:GetObjectTagging",
        "Resource": "arn:aws:s3:::iceberg/*"
      }
    ]
  }' \
  --duration-seconds 3600 \
  --endpoint-url "https://ozone-host.example.com:9881"