You can use the temporary security credentials using AssumeRole to access AWS resources from the same or different AWS accounts.
When you configure AssumeRole using
EC2 role or
IAM user, ensure that you have the
sts:AssumeRole
permission and a trust relationship established within the AWS accounts to use the temporary security credentials. The trust relationship is defined in the trust policy of the IAM role when you create the role. The IAM role adds the
EC2 role
or IAM user as a trusted entity allowing the
EC2 role or
IAM user to use the temporary security credentials and access the AWS accounts.
For more information about how to establish the trust relationship, see the AWS documentation.
When the trusted
EC2 role or
IAM user requests for the temporary security credentials, the AWS Security Token Service (AWS STS) dynamically generates the temporary security credentials that are valid for a specified period and provides the credentials to the trusted
EC2 role or
IAM user.
AssumeRole using EC2 role
To configure an EC2 role to assume the IAM role provided in the
IAM Role ARN
connection property, select the
Use EC2 Role to Assume Role
check box in the Amazon S3 V2 connection properties.
The Amazon EC2 role can assume another IAM role from the same or different AWS account without requiring a permanent access key and secret key. The Amazon EC2 role can also assume another IAM role from a different region.
Consider the following prerequisites before you configure AssumeRole using EC2 role:
Install the Secure Agent on an AWS service such as Amazon EC2.
The EC2 role attached to the AWS EC2 service must not have access to Amazon S3 but needs to have permission to assume another IAM role.
The IAM role that needs to be assumed by the EC2 role must have a permission policy and a trust policy attached to it.
AssumeRole using IAM user
To configure AssumeRole using IAM user, provide the value of the
IAM Role ARN
connection property when you create an Amazon S3 V2 connection. The IAM Role ARN uniquely identifies the AWS resources. Then, specify the time duration in seconds during which you can use the temporarily security credentials in the