Using IAM Roles Anywhere to Authorize Off-Cloud Devices to Access AWS Resources

Step-by-step guide to implementing AWS IAM Roles Anywhere for secure off-cloud device authentication. Learn how to use X.509 certificates and trust anchors to grant temporary AWS credentials to devices outside the cloud, including IoT devices and on-premises infrastructure.

silent.mo

Published Dec 19, 2025

Last modified Dec 19, 2025

IAM Role Anywhere

Concepts

IAM Roles Anywhere uses the CreateSession API to provide temporary credentials. Off-cloud devices request this API by passing parameters such as trust anchor, profile, assumed role, certificate, and a SigV4 signature generated using the certificate's private key.

When IAM Roles Anywhere receives the request, it first verifies the signature using the certificate's public key, then validates that the certificate was issued by a trust anchor previously configured in the account. After both verifications succeed, the application is authenticated, and IAM Roles Anywhere creates a new role session for the role specified in the request by calling AWS Security Token Service (AWS STS) to obtain temporary security credentials.

CreateSession is essentially an x509 wrapper around the AssumeRole API and is not currently included in any SDK. For detailed authentication information, please refer to [IAM Roles Anywhere](https://docs.aws.amazon.com/rolesanywhere/latest/userguide/authentication.html) authentication.

Therefore, in this example, we need to use a credential helper tool provided by IAM Roles Anywhere, which is compatible with the credential_process feature in various programming language SDKs. Currently, this tool supports three platforms: Linux, Windows, and Darwin (macOS).

Basic terminology:

Trust anchors: A trust anchor represents a trust relationship between IAM Roles Anywhere and one of your CA certificates. Devices use x509 certificates issued by the CA and trust anchors to authenticate and obtain temporary IAM credentials.
Roles: IAM roles with specific permissions that must trust the IAM Roles Anywhere service. Trust anchors are bound to IAM roles through the aws:SourceArncondition key.
Profiles: Used to specify roles that IAM Roles Anywhere can assume to obtain temporary credentials. We can also use session policies in profiles to restrict the permissions of temporary sessions.

Use Cases

IoT devices accessing cloud services, such as uploading application logs to Amazon S3
Data center equipment backing up data to S3
Data center machines accessing cloud resources in hybrid cloud deployments
Some unreasonable requirements that don't follow best practices. For example: startups where developers want local access to S3, and the boss is in a hurry and agrees

Configuration Process: Step by Step

Step 0: Prerequisites

1. Device has AWS CLI installed

2. Device has downloaded Credential-helper . Place the executable in the ~/.aws/ directory, or any other directory as long as you remember the path and the file has execute permissions.

Darwin is macOS

Step 1: Root CA Configuration

First, you need to have a Root CA. If you already have a PKI infrastructure, you can skip this step. Here we use AWS Private Certificate Authority to manage the PKI infrastructure. More information: What is AWS Private CA?

Of course, you can also maintain your own or integrate with existing PKI infrastructure, such as using OpenSSL or EasyRSA to generate a self-managed PKI infrastructure.

AWS IAM Roles Anywhere also supports external CA certificates.

Below is the AWS Private Certificate Authority configuration process:

Log in to AWS Private Certificate Authority
Click Create a private CA
On the creation page, select General-purpose for Mode options, Root for CA type options; fill in the corresponding Subject distinguished name options information, scroll down and click create

Step 2: Create Trust Anchors

1. Log in to IAM Console, click Roles, find Roles Anywhere

2. Click manage, then click Create a trust anchor

3. On the creation page, select the corresponding CA

Step 3: Create IAM Roles

1. Create a role in IAM Console using the Roles Anywhere use case

2. On the Add permissions page, select the corresponding permissions. This example uses AmazonS3FullAccess

In production, it is recommended to use a custom permission policy

3. Finally, enter the Role name and click Create role

Step 4: Generate Device Certificate

1. Request a private certificate in AWS Certificate Manager

2. View the details of the previously generated certificate, click Export, export the certificate (requires setting a password)

3. After exporting the certificate, download the Certificate body as device.crt file, download the Certificate private key as device-pass.key file

4. Decrypt the private key file in local terminal

1
openssl rsa -in device-pass.key -out device.key

Step 5: Configure AWS Config

1. Edit the configuration file vi ~/.aws/config, see **Config File Parameter Description** below for parameter details

1
2
3
4
5
6
7
[profile test-role-anywhere]    
region = us-east-1    
credential_process = /home/mile/.aws/aws_signing_helper credential-process \    
--certificate /app/device.crt --private-key /app/device.key \    
--trust-anchor-arn arn:aws:rolesanywhere:<region>:<account>:trust-anchor/<TA_ID> \    
--profile-arn arn:aws:rolesanywhere:<region>:<account>:profile/<PROFILE_ID> \    
--role-arn arn:aws:iam::<account>:role/<role-name>