What Actually Happens During an STS AssumeRole Call
~8 min read
The concrete request/response mechanics behind temporary credential vending, and where it happens invisibly.
What Actually Happens During an STS AssumeRole Call is a Pro topic
Sign in, then upgrade to Pro or Power to unlock this topic and the full AWS curriculum.
Key points
- •AssumeRole requires the caller to have permission via the target role's trust policy
- •Returns temporary access key ID, secret key, and session token, valid only for a set duration
- •The assumed role's permission policy determines what the temporary credentials can actually do
- •EC2 instance profiles, Lambda execution roles, and cross-account access all use this mechanism invisibly