AWS Security Cookbook

Granting permission for a non-admin user to switch roles using the CLI

We can grant permission for a non-admin user from the CLI as follows:

1. Create a policy document that allows AssumeRole on the child account role, that is, OrganizationAccountAccessRole and save it as assume-role-policy-document.json. Refer to the previous section for the JSON document structure.
2. Create the policy, as follows:

aws iam create-policy \--policy-name MyAssumeRolePolicyCLI \--policy-document file://resources/assume-role-policy-document.json \--profile awssecadmin

We should get the following response:

3. Attach this policy to the user group:

aws iam attach-group-policy ...