sts:AssumeRoleWithSAML is a Write access-level action in the sts service. Grants permission to obtain a set of temporary security credentials for users who have been authenticated via a SAML authentication response
ARNs that sts:AssumeRoleWithSAML can be scoped to in an IAM policy.
Keys you can use in the Condition block of a policy that grants sts:AssumeRoleWithSAML.
Filters access by the tags that are passed in the request
Filters access by the tag keys that are passed in the request
Filters access by the endpoint URL to which SAML assertions are presented
Filters access by the eduOrg attribute
Filters access by the commonName attribute
Filters access by on the principal that was used to assume the role
Filters access by the eduOrg attribute
Filters access by the eduOrg attribute
Filters access by the eduOrg attribute
Filters access by the eduOrg attribute
Filters access by the eduOrg attribute
Filters access by the eduPerson attribute
Filters access by the eduPerson attribute
Filters access by the eduPerson attribute
Filters access by the eduPerson attribute
Filters access by the eduPerson attribute
Filters access by the eduPerson attribute
Filters access by the eduPerson attribute
Filters access by the eduPerson attribute
Filters access by the eduPerson attribute
Filters access by the eduPerson attribute
Filters access by the eduPerson attribute
Filters access by the givenName attribute
Filters access by on the issuer, which is represented by a URN
Filters access by the mail attribute
Filters access by the name attribute
Filters access by the hash value of the issuer, account ID, and friendly name
Filters access by the organizationStatus attribute
Filters access by the primaryGroupSID attribute
Filters access by the subject of the claim (the SAML user ID)
Filters access by the value persistent, transient, or the full Format URI
Filters access by the surname attribute
Filters access by the uid attribute
Filters access by the uid attribute
Filters access by the role session name required when you assume a role
Filters access by the source identity that is passed in the request
Filters access by the transitive tag keys that are passed in the request
Filters access by the tags associated with the resource
Filters access by the tags that are attached to the role that is being assumed
A minimal policy that allows sts:AssumeRoleWithSAML. Replace "Resource": "*" with a specific ARN to follow least privilege.
{
"Version": "2012-10-17",
"Statement": [
{
"Sid": "AllowStsAssumeRoleWithSAML",
"Effect": "Allow",
"Action": "sts:AssumeRoleWithSAML",
"Resource": "*"
}
]
}