TL;DR

Use IAM Roles Anywhere to grant AWS access to on-premises workloads using your existing Windows PKI certificates - no long-lived access keys required. Export your subordinate CA cert as a trust anchor, create an IAM role with S3 read-only permissions, issue end-entity certificates, and use the AWS credential helper to obtain temporary credentials automatically.

Introduction

IAM Roles Anywhere enables workloads outside of AWS to access AWS resources using X.509 certificates issued by your existing certificate authority. This eliminates the need for long-lived IAM access keys for on-premises applications, scripts, and services.

This guide walks through setting up IAM Roles Anywhere using a Windows PKI (Active Directory Certificate Services) subordinate CA. The example demonstrates granting S3 read-only access to on-premises workloads.

Prerequisites

Before you begin, ensure you have:

Windows PKI - A Subordinate/Issuing CA (Active Directory Certificate Services)
AWS CLI - Installed and configured with IAM permissions
PowerShell - Run as Administrator where needed
AWS account - With permissions to create IAM roles and Roles Anywhere resources

Step 1: Export Your Subordinate CA Certificate

Export the subordinate CA certificate in PEM (Base-64) format to use as a trust anchor.

Find Your CA Information

On the Subordinate CA server, run:

# Get the CA name
(Get-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Services\CertSvc\Configuration").Active

# Get full CA config info
certutil -dump

Export the CA Certificate (GUI Method)

Open certsrv.msc on your Subordinate CA server
Right-click your CA name and select Properties
On the General tab, click View Certificate
Go to Details tab and click Copy to File...
Click Next
Select Base-64 encoded X.509 (.CER)
Save as C:\certs\SubordinateCA.pem

Export via Command Line (Alternative)

# Create certs directory
New-Item -ItemType Directory -Path "C:\certs" -Force

# The CA certificate should be in CertEnroll folder
# Copy and convert to Base64/PEM
certutil -encode "C:\Windows\System32\CertSrv\CertEnroll\sub01.corp.itarundaniel.com_Arun IssuingCA.crt" "C:\certs\SubordinateCA.pem"

Step 2: Create IAM Role for Roles Anywhere

Create an IAM role that IAM Roles Anywhere can assume with S3 read-only permissions.

Create Trust Policy File

Create trust-policy.json:

@'
{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Principal": {
                "Service": "rolesanywhere.amazonaws.com"
            },
            "Action": [
                "sts:AssumeRole",
                "sts:TagSession",
                "sts:SetSourceIdentity"
            ]
        }
    ]
}
'@ | Out-File -FilePath "trust-policy.json" -Encoding utf8

Create the IAM Role

aws iam create-role `
    --role-name RolesAnywhereRole-S3ReadOnly `
    --assume-role-policy-document file://trust-policy.json `
    --description "IAM Roles Anywhere role for S3 read-only access"

Attach S3 Read-Only Policy

aws iam attach-role-policy `
    --role-name RolesAnywhereRole-S3ReadOnly `
    --policy-arn arn:aws:iam::aws:policy/AmazonS3ReadOnlyAccess

Step 3: Create Trust Anchor in IAM Roles Anywhere

Create PowerShell Script for Trust Anchor

Create create-trust-anchor.ps1:

# Script to create IAM Roles Anywhere Trust Anchor from a PEM certificate file
# Usage: .\create-trust-anchor.ps1 -CertFile "SubordinateCA.pem" -TrustAnchorName "TrustAnchor-WindowsPKI-SubordinateCA"

param(
    [Parameter(Mandatory=$true)]
    [string]$CertFile,

    [Parameter(Mandatory=$true)]
    [string]$TrustAnchorName
)

# Read the certificate
$certContent = Get-Content $CertFile -Raw

# Create the JSON object
$jsonObject = @{
    name = $TrustAnchorName
    source = @{
        sourceType = "CERTIFICATE_BUNDLE"
        sourceData = @{
            x509CertificateData = $certContent.TrimEnd()
        }
    }
    enabled = $true
}

# Convert to JSON and save to temp file
$jsonPath = Join-Path $env:TEMP "trust-anchor-temp.json"
$jsonObject | ConvertTo-Json -Depth 10 | Out-File -FilePath $jsonPath -Encoding utf8NoBOM

# Create the trust anchor
Write-Host "Creating trust anchor '$TrustAnchorName' from '$CertFile'..."
aws rolesanywhere create-trust-anchor --cli-input-json "file://$jsonPath"

# Clean up
Remove-Item $jsonPath -Force

Run the Script

.\create-trust-anchor.ps1 -CertFile "C:\certs\SubordinateCA.pem" -TrustAnchorName "TrustAnchor-WindowsPKI-SubordinateCA"

Pro Tip

Save the Trust Anchor ARN from the output. You can retrieve it later with: aws rolesanywhere list-trust-anchors --query "trustAnchors[?name=='TrustAnchor-WindowsPKI-SubordinateCA'].trustAnchorArn" --output text

Step 4: Create a Profile in IAM Roles Anywhere

Get Account ID Automatically

$accountId = aws sts get-caller-identity --query Account --output text

Create the Profile

aws rolesanywhere create-profile `
    --name "Profile-S3ReadOnly" `
    --role-arns "arn:aws:iam::${accountId}:role/RolesAnywhereRole-S3ReadOnly" `
    --enabled

Note

Save the Profile ARN from the output. Format: arn:aws:rolesanywhere:REGION:ACCOUNT_ID:profile/PROFILE_ID

Step 5: Update IAM Role Trust Policy with Conditions

Add conditions to restrict which certificates can assume the role.

Get Your Trust Anchor ARN and CA Common Name

$trustAnchorArn = aws rolesanywhere list-trust-anchors --query "trustAnchors[?name=='TrustAnchor-WindowsPKI-SubordinateCA'].trustAnchorArn" --output text
Write-Host "Trust Anchor ARN: $trustAnchorArn"

$caCN = (Get-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Services\CertSvc\Configuration").Active
Write-Host "CA Common Name: $caCN"

Create Updated Trust Policy

Create trust-policy-with-conditions.json (replace values with your actual ARN and CN):

$trustAnchorArn = "arn:aws:rolesanywhere:us-east-1:YOUR_ACCOUNT_ID:trust-anchor/YOUR_TA_ID"
$caCN = "Arun IssuingCA"

@"
{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Principal": {
                "Service": "rolesanywhere.amazonaws.com"
            },
            "Action": [
                "sts:AssumeRole",
                "sts:TagSession",
                "sts:SetSourceIdentity"
            ],
            "Condition": {
                "ArnEquals": {
                    "aws:SourceArn": "$trustAnchorArn"
                },
                "StringEquals": {
                    "aws:PrincipalTag/x509Issuer/CN": "$caCN"
                }
            }
        }
    ]
}
"@ | Out-File -FilePath "trust-policy-with-conditions.json" -Encoding utf8

Apply the Updated Trust Policy

aws iam update-assume-role-policy `
    --role-name RolesAnywhereRole-S3ReadOnly `
    --policy-document file://trust-policy-with-conditions.json

Important

Adding conditions ensures only certificates from your specific CA can assume this role. This is a critical security control - don't skip this step in production.

Step 6: Issue End-Entity Certificate from Windows CA

Issue a certificate for your workload from your Subordinate CA.

Create Certificate Request INF File

Create request.inf on the machine that will use the certificate:

@'
[Version]
Signature = "$Windows NT$"

[NewRequest]
Subject = "CN=s3readonly.corp.itarundaniel.com"
KeySpec = 1
KeyLength = 2048
Exportable = TRUE
MachineKeySet = TRUE
SMIME = FALSE
PrivateKeyArchive = FALSE
UserProtected = FALSE
UseExistingKeySet = FALSE
ProviderName = "Microsoft RSA SChannel Cryptographic Provider"
ProviderType = 12
RequestType = PKCS10
KeyUsage = 0xa0

[RequestAttributes]
CertificateTemplate = WebServer
'@ | Out-File -FilePath "request.inf" -Encoding ascii

Generate and Submit the Certificate Request

# Generate the certificate request
certreq -new request.inf request.csr

# Submit request to Subordinate CA
certreq -submit -config "sub01.corp.itarundaniel.com\Arun IssuingCA" -attrib "CertificateTemplate:WebServer" request.csr certificate.cer

# Accept the certificate
certreq -accept certificate.cer

Pro Tip

If the WebServer template doesn't exist, check available templates: certutil -CATemplates -config "sub01.corp.itarundaniel.com\Arun IssuingCA"

Export Certificate to PFX

# Create certs directory if it doesn't exist
New-Item -ItemType Directory -Path "C:\certs" -Force

# Find the certificate thumbprint
$thumbprint = (Get-ChildItem -Path Cert:\LocalMachine\My | Where-Object {$_.Subject -like "*s3readonly*"}).Thumbprint
Write-Host "Certificate Thumbprint: $thumbprint"

# Export to PFX
$password = ConvertTo-SecureString -String "ExportPassword123" -Force -AsPlainText
Export-PfxCertificate -Cert "Cert:\LocalMachine\My\$thumbprint" -FilePath "C:\certs\s3readonly.pfx" -Password $password

Write-Host "Certificate exported to C:\certs\s3readonly.pfx"

Import to User Certificate Store

The credential helper uses the user certificate store by default:

certutil -user -p "ExportPassword123" -importPFX "MY" C:\certs\s3readonly.pfx

# Verify the import
Get-ChildItem -Path Cert:\CurrentUser\My | Where-Object {$_.Subject -like "*s3readonly*"}

Step 7: Download and Configure the Credential Helper

Download for Windows

# Create tools directory
New-Item -ItemType Directory -Path "C:\certs" -Force

# Download the credential helper
Invoke-WebRequest -Uri "https://rolesanywhere.amazonaws.com/releases/1.7.3/X86_64/Windows/Server2019/aws_signing_helper.exe" -OutFile "C:\certs\aws_signing_helper.exe"

Write-Host "Downloaded aws_signing_helper.exe to C:\certs\"

Test the Credential Helper

Replace the ARNs with your actual values:

# Set your ARNs (get these from Steps 3 and 4)
$trustAnchorArn = "arn:aws:rolesanywhere:us-east-1:YOUR_ACCOUNT_ID:trust-anchor/YOUR_TA_ID"
$profileArn = "arn:aws:rolesanywhere:us-east-1:YOUR_ACCOUNT_ID:profile/YOUR_PROFILE_ID"
$roleArn = "arn:aws:iam::YOUR_ACCOUNT_ID:role/RolesAnywhereRole-S3ReadOnly"

# Test the credential helper
C:\certs\aws_signing_helper.exe credential-process `
    --cert-selector "Key=x509Subject,Value=CN=s3readonly.corp.itarundaniel.com" `
    --trust-anchor-arn $trustAnchorArn `
    --profile-arn $profileArn `
    --role-arn $roleArn

Expected output - JSON with temporary credentials:

{
    "Version": 1,
    "AccessKeyId": "ASIAXXX...",
    "SecretAccessKey": "xxx...",
    "SessionToken": "xxx...",
    "Expiration": "2024-01-15T12:00:00Z"
}

Step 8: Configure AWS CLI Profile

Add the following to your AWS config file (%USERPROFILE%\.aws\config):

[profile rolesanywhere-s3readonly]
credential_process = C:\certs\aws_signing_helper.exe credential-process --cert-selector Key=x509Subject,Value=CN=s3readonly.corp.itarundaniel.com --trust-anchor-arn arn:aws:rolesanywhere:us-east-1:YOUR_ACCOUNT_ID:trust-anchor/YOUR_TA_ID --profile-arn arn:aws:rolesanywhere:us-east-1:YOUR_ACCOUNT_ID:profile/YOUR_PROFILE_ID --role-arn arn:aws:iam::YOUR_ACCOUNT_ID:role/RolesAnywhereRole-S3ReadOnly
region = us-east-1

Step 9: Verify Everything Works

Test Identity

aws sts get-caller-identity --profile rolesanywhere-s3readonly

Expected output:

{
    "UserId": "AROAXXXXXXXXX:session-name",
    "Account": "YOUR_ACCOUNT_ID",
    "Arn": "arn:aws:sts::YOUR_ACCOUNT_ID:assumed-role/RolesAnywhereRole-S3ReadOnly/session-name"
}

Test S3 Access

aws s3 ls --profile rolesanywhere-s3readonly

You should see a list of S3 buckets in the account.

Resource Summary

Resource	Name	Purpose
Trust Anchor	TrustAnchor-WindowsPKI-SubordinateCA	Links your Windows CA to AWS
IAM Role	RolesAnywhereRole-S3ReadOnly	Defines permissions (S3 read-only)
Profile	Profile-S3ReadOnly	Links trust anchor to role
Certificate	CN=s3readonly.corp.itarundaniel.com	Identity for the workload

Troubleshooting

Common errors and their solutions:

"AccessDeniedException: Unable to assume role" - Role trust policy doesn't trust Roles Anywhere. Update trust policy (Step 5).
"Certificate not trusted" - CA certificate not correctly uploaded. Re-upload trust anchor (Step 3).
"No certificate found" - Certificate not in user store. Import with certutil -user (Step 6).
"Bad certificate data" - JSON formatting issue with PEM. Use the PowerShell script (Step 3).
"CertificateTemplate request attribute" - Missing template in cert request. Add template to INF file (Step 6).

Diagnostic Commands

# Verify certificate in user store
Get-ChildItem -Path Cert:\CurrentUser\My | Where-Object {$_.Subject -like "*s3readonly*"}

# Verify certificate in machine store
Get-ChildItem -Path Cert:\LocalMachine\My | Where-Object {$_.Subject -like "*s3readonly*"}

# Read certificate data
C:\certs\aws_signing_helper.exe read-certificate-data --cert-selector "Key=x509Subject,Value=CN=s3readonly.corp.itarundaniel.com"

# List trust anchors
aws rolesanywhere list-trust-anchors

# List profiles
aws rolesanywhere list-profiles

# Get role trust policy
aws iam get-role --role-name RolesAnywhereRole-S3ReadOnly --query "Role.AssumeRolePolicyDocument"

Security Best Practices

Protect private keys - Use Windows Certificate Store instead of PEM files
Use restrictive trust policy conditions - Limit which certificates can assume roles
Rotate certificates - Implement certificate renewal before expiration
Monitor usage - Enable CloudTrail logging for IAM Roles Anywhere activity
Least privilege - Only grant the minimum permissions needed
Use separate certificates - Issue unique certificates per workload/service

Clean Up (If Needed)

# Delete the profile
aws rolesanywhere delete-profile --profile-id YOUR_PROFILE_ID

# Delete the trust anchor
aws rolesanywhere delete-trust-anchor --trust-anchor-id YOUR_TA_ID

# Delete the IAM role (detach policies first)
aws iam detach-role-policy --role-name RolesAnywhereRole-S3ReadOnly --policy-arn arn:aws:iam::aws:policy/AmazonS3ReadOnlyAccess
aws iam delete-role --role-name RolesAnywhereRole-S3ReadOnly

# Remove certificate from user store
$cert = Get-ChildItem -Path Cert:\CurrentUser\My | Where-Object {$_.Subject -like "*s3readonly*"}
Remove-Item -Path $cert.PSPath

Conclusion

IAM Roles Anywhere eliminates the need for long-lived IAM access keys for on-premises workloads by leveraging your existing PKI infrastructure. Once configured, your workloads automatically receive temporary credentials that are refreshed as needed - no more rotating access keys or worrying about credential exposure.

The key components are: a trust anchor (your CA certificate), an IAM role with appropriate permissions, a profile linking them together, and the credential helper running on your workload. With these in place, your on-premises applications can securely access AWS resources using the same certificate-based identity they already use for other enterprise services.