The Multi-Account Access Problem
Modern AWS architectures use separate accounts for different environments: one for development, one for staging, one for production. A developer in the dev account needs to occasionally read logs from the production account. How do you grant this without:
- Creating a new IAM user in the production account (credential sprawl)
- Sharing long-lived access keys (security risk)
- Giving the developer permanent production access (least-privilege violation)
The answer is Cross-Account Role Assumption using AWS STS (Security Token Service).
The Two-Part Handshake
Cross-account access requires both accounts to agree. Think of it as a visa application: the traveler's home country must allow them to travel (Account A's permission), and the destination country must agree to let them in (Account B's trust policy).
Account B (the target account) creates the role and attaches a Trust Policy — a resource policy naming Account A as a trusted Principal and permitting it to call sts:AssumeRole, typically with a Condition requiring a shared ExternalId value known only to the two parties.
The ExternalId condition prevents the confused deputy problem — a scenario where a malicious third party tricks a service into assuming a role on their behalf by knowing only the role ARN.
Account A then grants its own developer identity a matching Identity Policy allowing sts:AssumeRole against that specific role ARN in Account B — the mirror image of the trust policy, without which the developer can't even attempt the handshake.
With both sides in place, the developer calls sts:AssumeRole (passing the role ARN, a session name, and the agreed ExternalId), and STS returns a set of temporary credentials scoped to exactly what ReadLogsRole permits — nothing more.
Key architectural insight: Temporary credentials are always preferable to long-lived access keys. They expire automatically (valid for 1 hour by default, configurable up to 12), they are scoped to a specific role's permissions, and they leave an audit trail in CloudTrail with the session name you provided.