Assume Role as an IAM User

When assuming an IAM role, you get a set of temporary credentials you can use to access resources as defined by the attached IAM policies.

Prerequisites

• An IAM user UserTest in AccountExample.

• An IAM role in AccountExample2 with a trust policy enabling UserTest to assume the role.

Procedure

Using the CLI

Run the following command to assume the role and get temporary credentials.

aws --endpoint-url https://sts.<base-domain-name> sts assume-role --role-arn arn:aws:iam::123456789012:role/ExampleRole1 --role-session-name session-example

<ROLE_ARN> is an IAM role ARN you created, or one of the default ARTESCA roles:

• arn:aws:iam::123456789:role/scality-internal/storage-manager-role

• arn:aws:iam::123456789:role/scality-internal/storage-account-owner-role

• arn:aws:iam::123456789:role/scality-internal/data-consumer-role

Output example:

{
    "AssumedRoleUser": {
        "AssumedRoleId": "AROA3XFRBF535PLBIFPI4:session-example",
        "Arn": "arn:aws:sts::123456789012:assumed-role/ExampleRole1/session-example"
    },
    "Credentials": {
        "SecretAccessKey": "9drTJvcXLB89EXAMPLELB8923FB892xMFI",
        "SessionToken": "AQoXdzELDDY////EXAMPLE/////Kcgo5OytwU=",
        "Expiration": "2016-03-15T00:05:07Z",
        "AccessKeyId": "ASIAJEXAMPLEXEG2JICEA"
    }
}

Note

Refer to Use AWS CLI with Temporary Credentials to start using those temporary credentials.

Using the API

The assume-role API enables the IAM user to assume roles in the current account or in other accounts.