AWS Security Cookbook

Switching roles between any two accounts

Please note that it is not necessary for the accounts to be a part of an AWS Organization to perform role switching. This can be configured between any two accounts. To allow a user group, for example, testusergroup, from account A to switch role to account B, we can follow these steps:

1. Create a policy in account B with required access permissions to resources in account B.
2. Create a role in account B with the trusted entity as account A and attach the policy we created in the previous step.
3. Account A's admin should grant the STS:AssumeRole permission for the role we created in the previous step by providing the complete role ARN to the required users or groups in account A so that they can assume ...