sts:AssumeRole is a Write access-level action in the sts service. Grants permission to obtain a set of temporary security credentials that you can use to access AWS resources that you might not normally have access to
ARNs that sts:AssumeRole can be scoped to in an IAM policy.
Keys you can use in the Condition block of a policy that grants sts:AssumeRole.
Filters access by the Google application ID
Filters access by the subject of the claim (the Google user ID)
Filters access by the tags that are passed in the request
Filters access by the tag keys that are passed in the request
Filters access by the login information for Amazon Cognito
Filters access by the Amazon Cognito identity pool ID
Filters access by the subject of the claim (the Amazon Cognito user ID)
Filters access by the Facebook application ID
Filters access by the Facebook user ID
Filters access by the tags that are attached to the role that is being assumed
Filters access by the hash value of the issuer, account ID, and friendly name
Filters access by the subject of the claim (the SAML user ID)
Filters access by the value persistent, transient, or the full Format URI
Filters access by the unique identifier required when you assume a role in another account
Filters access by the role session name required when you assume a role
Filters access by the source identity that is passed in the request
Filters access by the transitive tag keys that are passed in the request
Filters access by the Login with Amazon application ID
Filters access by the Login with Amazon user ID
Filters access by the tags associated with the resource
A minimal policy that allows sts:AssumeRole. Replace "Resource": "*" with a specific ARN to follow least privilege.
{
"Version": "2012-10-17",
"Statement": [
{
"Sid": "AllowStsAssumeRole",
"Effect": "Allow",
"Action": "sts:AssumeRole",
"Resource": "*"
}
]
}