Assume Role
Identity & AccessAssuming a role means calling the AWS Security Token Service (STS) AssumeRole API to obtain temporary credentials (access key ID, secret access key, and session token) that grant the permissions of the target role.
The caller must be authorized to assume the role via the role's trust policy (a resource-based policy that defines who can assume it). The temporary credentials expire after a configurable duration (default 1 hour, max 12 hours).
AssumeRole Variants
AssumeRole- for IAM users or roles in the same or different accountAssumeRoleWithSAML- for SAML-federated users (e.g., from Active Directory)AssumeRoleWithWebIdentity- for users authenticated by an OIDC provider (e.g., Google, Cognito)
Related Content
Related Terms
An AWS identity with temporary credentials that can be assumed by users, services, or applications to perform actions without long-term access keys.
Short-lived AWS credentials (access key, secret key, session token) issued by STS that expire automatically, eliminating the risk of permanent credential exposure.
A resource-based policy attached to an IAM role that defines which principals (users, services, accounts) are allowed to assume that role.
The ability to grant permissions for identities in one AWS account to access resources in another, typically using IAM roles with trust policies.
Toc Consulting: AWS Security & Cloud Architecture
Securing your AWS estate?
Our team helps engineering teams secure and architect AWS the right way: assessment in week one, a prioritized action plan in week two.