Ditching the Access Key: Implementing IAM Roles Anywhere for Secure Edge and On-Prem Workloads

#security #aws

In the early days of AWS, if you had a server in your local data center that needed to upload logs to S3, you likely did the unthinkable: you created an IAM User, generated an access_key_id and secret_access_key, and hardcoded them into a config file.

By 2026, this practice is not just outdated. It is a major compliance liability. Long-lived credentials are "static" targets for attackers. As AWS Community Builders, we should advocate for Zero Trust architectures. Enter IAM Roles Anywhere.

This service allows your non-AWS workloads (servers, containers, or IoT devices) to use X.509 digital certificates to obtain temporary, short-lived AWS credentials. No more static keys. No more manual rotation.

The Architecture of Trust

The workflow relies on a Public Key Infrastructure (PKI) chain:

Trust Anchor: You tell AWS which Certificate Authority (CA) to trust.
Profile: You define which IAM Roles can be assumed and for how long.
Role: An IAM Role with a trust policy that allows the rolesanywhere.amazonaws.com service principal to assume it.

Step 1: Infrastructure as Code (CloudFormation)

We'll start by defining the AWS-side resources. In this example, we assume you have a CA certificate (PEM format) from your internal PKI or a tool like OpenSSL.

AWSTemplateFormatVersion: '2010-09-09'
Description: Deploy IAM Roles Anywhere for On-Premise Workloads

Parameters:
  CACertificateBody:
    Type: String
    Description: The PEM-encoded Public Key of your Certificate Authority.

Resources:
  EdgeTrustAnchor:
    Type: AWS::RolesAnywhere::TrustAnchor
    Properties:
      Name: OnPremDataCenterAnchor
      Enabled: true
      Source:
        SourceData:
          X509CertificateData: !Ref CACertificateBody
        SourceType: CERTIFICATE_BUNDLE

  EdgeWorkloadRole:
    Type: AWS::IAM::Role
    Properties:
      RoleName: EdgeBackupRole
      AssumeRolePolicyDocument:
        Version: '2012-10-17'
        Statement:
          - Effect: Allow
            Principal:
              Service: rolesanywhere.amazonaws.com
            Action:
              - sts:AssumeRole
              - sts:TagSession
              - sts:SetSourceIdentity
            Condition:
              StringEquals:
                "aws:PrincipalTag/x509Subject/OU": "DataCenter-Northeast"
      ManagedPolicyArns:
        - arn:aws:iam::aws:policy/AmazonS3FullAccess # Scoped to your needs

  EdgeProfile:
    Type: AWS::RolesAnywhere::Profile
    Properties:
      Name: EdgeServerProfile
      DurationSeconds: 3600 # 1-hour temporary credentials
      Enabled: true
      RoleArns:
        - !GetAtt EdgeWorkloadRole.Arn

Step 2: Preparing the Edge Server

On your on-premise server, you need two things:

A Client Certificate and Private Key signed by the CA you uploaded to the Trust Anchor.
The AWS Signing Helper tool (provided by AWS).

The Credential Process Logic
To make this seamless for the AWS CLI or SDKs, we use the credential_process feature in the AWS config file. This allows the CLI to call the signing helper automatically whenever credentials expire.

Update your ~/.aws/config on the edge server:

[profile edge-workload]
credential_process = /usr/local/bin/aws_signing_helper credential-process \
    --certificate /etc/pki/edge/server.crt \
    --private-key /etc/pki/edge/server.key \
    --trust-anchor-arn arn:aws:rolesanywhere:us-east-1:123456789012:trust-anchor/your-anchor-id \
    --profile-arn arn:aws:rolesanywhere:us-east-1:123456789012:profile/your-profile-id \
    --role-arn arn:aws:iam::123456789012:role/EdgeBackupRole

Step 3: Python Implementation (Boto3)

Once the config is set up, your application code doesn't even need to know IAM Roles Anywhere exists. It simply uses the profile.

import boto3
from botocore.exceptions import ClientError

def upload_to_s3(file_name, bucket):
    session = boto3.Session(profile_name='edge-workload')
    s3 = session.client('s3')

    try:
        s3.upload_file(file_name, bucket, file_name)
        print(f"Successfully uploaded {file_name} using temporary credentials!")
    except ClientError as e:
        print(f"Upload failed: {e}")

if __name__ == "__main__":
    upload_to_s3('daily_backup.tar.gz', 'my-secure-onprem-backups')

Why This Matters

Zero Static Secrets: If your edge server is stolen, there are no AWS keys to harvest from the disk.
Instant Revocation: Revoke the certificate at your CA, and access is blocked immediately without touching AWS IAM.
Auditability: Every session creation is logged in CloudTrail with the unique certificate serial number.