Skip to content

Instantly share code, notes, and snippets.

@aldy120

aldy120/assume-role.sh

Last active February 24, 2022 22:04
Show Gist options

  • Select an option

    Learn more about clone URLs
  • Save aldy120/1104b3c1d735432352bffed9c49c08d3 to your computer and use it in GitHub Desktop.

Select an option

Learn more about clone URLs
Save aldy120/1104b3c1d735432352bffed9c49c08d3 to your computer and use it in GitHub Desktop.
Download ZIP
assume role
Raw
assume-role.sh
aws sts assume-role --role-arn arn:aws:iam::32522793xxxx:role/admin-32522793xxxx --role-session-name xxx
{
"Credentials": {
"AccessKeyId": "ASIAUXOIYM7XXDCJxxxx",
"SecretAccessKey": "********",
"SessionToken": ""*******************",",
"Expiration": "2022-02-24T01:16:44+00:00"
},
"AssumedRoleUser": {
"AssumedRoleId": "AROAUXOIYM7XYUEUW****:asdf",
"Arn": "arn:aws:sts::32522793xxxx:assumed-role/admin-32522793xxxx/asdf"
}
}
@aldy120
Copy link
Author

aldy120 commented Feb 24, 2022 •
edited
Loading

There should be enoung

  • IAM identity policy
  • Assumed role trust policy

https://docs.aws.amazon.com/cli/latest/userguide/cli-configure-role.html#cli-role-prepare
Required permissions for the identity to assume role.

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": "sts:AssumeRole",
      "Resource": "arn:aws:iam::123456789012:role/marketingadminrole"
    }
  ]
}

The trust policy of assumed role must have permission for the account.

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": {
        "AWS": "arn:aws:iam::123456789012:root"
      },
      "Action": "sts:AssumeRole"
    }
  ]
}

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment