aws assume role basics

AWS Assume role allow a principal (an IAM user or role) to temporarily assume a different IAM role and receive temporary credentials (AccessKeyId, SecretAccessKey, SessionToken). You use this when:

• Accessing another AWS account (cross-account access),

• Escalating privileges temporarily,

• Following least privilege principles.

So you need to create a role, define who can assume this newly create role and finally you need to specify what permission tied to it. Otherwise, there's no reason to do this. :) 

In your IAM console, click on Create Role. 

Then select "Custom Trust policy".  

   

Then specify, the principal who can assume this role. 

{

  "Version": "2012-10-17",

  "Statement": [

    {

      "Sid": "Statement1",

      "Effect": "Allow",

      "Principal": {

        "AWS": "arn:aws:iam::your-aws-id:user/jeremydev"

      },

      "Action": "sts:AssumeRole"

    }

  ]

}

Then proceed to configure your permission. Here we will chose AmazonS3FuillAccess. Click Next. Then provide a name here we will call it "s3fullaccess-atr", description and then click "create".

Once we have done, that, let's go an assume this role to get access to our s3 buckets.

aws sts assume-role --role-arn arn:aws:iam::your-amazon-id:role/s3fullaccess-atr --role-session-name s3-session

Then you will get the following outputs :-

Then proceed to export these as your environment variables - for example 

export AWS_ACCESS_KEY_ID=ASIA...

export AWS_SECRET_ACCESS_KEY=abc...

export AWS_SESSION_TOKEN=FQoG...

Then try to run the following command:-

aws s3 ls 

If you don't have the permission then you will get error similar to the one shown below

An error occurred (AccessDenied) when calling the AssumeRole operation: User: arn:aws:iam::your-amazon-id:user/jeremydev is not authorized to perform: sts:AssumeRole on resource: arn:aws:iam::your-amazon-id:role/s3fullaccess-atr