15

On occasion, I need to access multiple AWS resources that I have individual access for with separate IAM roles. If I need these resources to be used together, I currently have to figure out a non-native connector piece.

If I could access the resources together at the same time, I can sometimes use an AWS connector to interface with both resources at once (for example).

Is there a way to assume multiple IAM roles at the same time?

1 Answer 1

31

Technically, yes, there is a way to assume multiple IAM roles at the same time.

But it doesn't mean what you intend.

Assuming an IAM role doesn't modify who you are and doesn't modify what permissions you have -- contrary to the intuitive interpretation of what it might mean to assume a different identity. Instead, when you assume a role, you are given a new set of temporary credentials to use, instead of "your" credentials -- the credentials you used to assume the role.

Requests made with these temporary credentials are authorized against the permissions granted to the role.

Thus, while you can assume multiple roles at the same time, each of those actions has a separate set of associated credentials, so it won't allow you to make requests that require you to have the permissions of more than one role for any given request.

Every request is performed by a single principal, so if you are trying to perform a single action that requires the union of the permissions of multiple roles, that's a not possible.

1
  • 15
    The last line was what I was afraid of. Is there a good way to get the union of permissions? I need to assume a role coming from a different account, but give that role permissions to my current account so I can interface with 2 services split between the accounts.
    – ignorance
    Feb 20, 2018 at 17:30

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.