You can configure AssumeRole via

EC2 role or

IAM user to connect to Amazon S3.

You can use the temporary security credentials using AssumeRole to access AWS resources from the same or different AWS accounts.

When you use AssumeRole via

EC2 role

or IAM user authentication, ensure that you have the

sts:AssumeRole

permission and a trust relationship established within the AWS accounts to use the temporary security credentials. The trust relationship is defined in the trust policy of the IAM role when you create the role. The IAM role adds the

EC2 role

or IAM user as a trusted entity allowing the

EC2 role or

IAM user to use the temporary security credentials and access the AWS accounts.

For more information about how to establish the trust relationship, see the AWS documentation.

When the trusted

EC2 role or

IAM user requests for the temporary security credentials, the AWS Security Token Service (AWS STS) dynamically generates the temporary security credentials that are valid for a specified period and provides the credentials to the trusted

EC2 role or

IAM user.

To configure an EC2 role to assume the IAM role provided in the

IAM Role ARN

connection property, select the

Use EC2 Role to Assume Role

check box in the Amazon S3 V2 connection properties.

The Amazon EC2 role can assume another IAM role from the same or different AWS account without requiring a permanent access key and secret key. The Amazon EC2 role can also assume another IAM role from a different region.

Consider the following prerequisites before you use AssumeRole via EC2 role:

Install the Secure Agent on an AWS service such as Amazon EC2.
The EC2 role attached to the AWS EC2 service must not have access to Amazon S3 but needs to have permission to assume another IAM role.
The IAM role that needs to be assumed by the EC2 role must have a permission policy and a trust policy attached to it.

To use AssumeRole via IAM user, provide the value of the

IAM Role ARN

connection property when you create an Amazon S3 V2 connection. The IAM Role ARN uniquely identifies the AWS resources. Then, specify the time duration in seconds during which you can use the temporarily security credentials in the

Temporary Credential Duration

advanced source

and target

properties.