Connectors and Connections

Back Next

AssumeRole policy

To use the temporary security credentials to access the AWS resources, both the IAM user and IAM role require policies.

The following section lists the policies required for the IAM user and IAM role:

IAM user: An IAM user must have the
sts:AssumeRole
policy to use the temporary security credentials in the same or different AWS account.; The following sample policy allows an IAM user to use the temporary security credentials in an AWS account:
{ "Version":"2012-10-17", "Statement":{ "Effect":"Allow", "Action":"sts:AssumeRole", "Resource":"arn:aws:iam::<ACCOUNT-HYPHENS>:role/<ROLE-NAME>" } }; The following sample policy allows an IAM user for the China region to use the temporary security credentials in an AWS account:
{ "Version":"2012-10-17", "Statement":{ "Effect":"Allow", "Action":"sts:AssumeRole", "Resource":"arn:aws-cn:iam::<ACCOUNT-HYPHENS>:role/<ROLE-NAME>" } }

IAM role: An IAM role must have a
sts:AssumeRole
policy and a trust policy attached with the IAM role to allow the IAM user to access the AWS resource using the temporary security credentials. The policy specifies the AWS resource that the IAM user can access and the actions that the IAM user can perform. The trust policy specifies the IAM user from the AWS account that can access the AWS resource.
The following policy is a sample trust policy:
{ "Version":"2012-10-17", "Statement":[{ "Effect":"Allow", "Principal":{ "AWS":"arn:aws:iam::AWS-account-ID:root" }, "Action":"sts:AssumeRole" } ] } }
Here, in the
Principal
attribute, you can also provide the ARN of IAM user, which allows the designated user to dynamically generate temporary security credentials and helps to restrict further access.

For example,
"Principal" : { "AWS" : "arn:aws:iam:: AWS-account-ID :user/ user-name " }