When an IAM user from account A tries to assume a role in account B, the IAM user needs to specify an external ID to be authenticated to assume this role even though you have defined the rules and policies for the IAM user and IAM role.
Perform the following steps on the AWS console to configure the assume role:
Log in to the
AWS Console
.
Click
Dashboard
from the left panel.
The
AWS Service
dashboard page appears.
Click
IAM
.
The
Welcome to Identity and Access Management
page appears.
Click
Policies
from the left panel.
Configure the policies for the IAM user that you configure when the IAM user and the IAM role are in different accounts.
Click
Roles
from the left panel.
Configure the policies for the IAM role that you configure when the IAM user and the IAM role are in different accounts.
Click
Trust relationships
tab to view the trust relationship for the AWS account.
Click
Edit trust relationship
to define the trust relationship.
The
Edit Trust Relationship
window opens.
Edit the policy and specify the conditions for the external ID.
The following image shows the condition that you defined for the external ID:
Click
Update Trust Policy
.
The
Trust relationships
tab shows the external ID condition and the value that you specified.