The right way to Assume Function throughout Accounts in AWS

If it’s worthwhile to assume position between AWS accounts, or permit an account to imagine a job and use assets in one other AWS account, then it’s worthwhile to create a job and fix the next coverage.

The next two (2) steps creates a Belief Relationship between the accounts.

Step 1 – Within the Supply Account

{
  "Model": "2012-10-17",
  "Assertion": [{
    "Effect": "Allow",
    "Action": [
      "sts:AssumeRole"
    ],
    "Useful resource": [
      "arn:aws:iam::DESTINATION-ACCOUNT-ID:role/DESTINATION-ROLENAME"
    ]
  }]
}

Step 2 – Within the Vacation spot Account

{
  "Model": "2012-10-17",
  "Assertion": [{
    "Effect": "Allow",
    "Principal": {
      "AWS": "arn:aws:iam::SOURCE-ACCOUNT-ID:role/SOURCE-USERNAME"
    },
    "Action": "sts:AssumeRole"
  }]
}