sts:SetSourceIdentity

Write

sts:SetSourceIdentity is a Write access-level action in the sts service. Grants permission to set a source identity on a STS session

Resource types

ARNs that sts:SetSourceIdentity can be scoped to in an IAM policy.

arn:${Partition}:iam::${Account}:role/${RoleNameWithPath}
role

Condition keys

Keys you can use in the Condition block of a policy that grants sts:SetSourceIdentity.

sts:SourceIdentity String

Filters access by the source identity that is passed in the request

aws:ResourceTag/${TagKey} String

Filters access by the tags associated with the resource

iam:ResourceTag/${TagKey} String

Filters access by the tags that are attached to the role that is being assumed

Example IAM policy

A minimal policy that allows sts:SetSourceIdentity. Replace "Resource": "*" with a specific ARN to follow least privilege.

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "AllowStsSetSourceIdentity",
      "Effect": "Allow",
      "Action": "sts:SetSourceIdentity",
      "Resource": "*"
    }
  ]
}

Related actions in sts

sts:AssumeRole Write sts:AssumeRoleWithSAML Write sts:AssumeRoleWithWebIdentity Write sts:AssumeRoot Write sts:DecodeAuthorizationMessage Write sts:GetAccessKeyInfo Read sts:GetCallerIdentity Read sts:GetDelegatedAccessToken Write sts:GetFederationToken Write sts:GetServiceBearerToken Read sts:GetSessionToken Read sts:GetWebIdentityToken Write

View all sts actions →