Assuming roles for temporary access in AWS - Step-by-Step Execution

Process Flow - Assuming roles for temporary access

User wants access

↓

Call AssumeRole API

↓

STS returns temporary credentials

↓

Use temporary credentials to access resources

↓

Credentials expire after duration

↓

Access denied if credentials expired

User requests temporary access by calling AssumeRole, receives temporary credentials, uses them, and access ends when credentials expire.

Execution Sample

AWS

aws sts assume-role \
  --role-arn arn:aws:iam::123456789012:role/demo \
  --role-session-name session1

This command requests temporary credentials by assuming the specified IAM role.

Process Table

Step	Action	Input	Output	Result
1	User initiates AssumeRole	Role ARN: arn:aws:iam::123456789012:role/demo, Session Name: session1	API call sent to STS	Request accepted
2	STS processes request	Valid role ARN and permissions	Temporary credentials (AccessKeyId, SecretAccessKey, SessionToken)	Credentials issued
3	User uses credentials	Temporary credentials	Access to AWS resources	Access granted
4	Credentials expire	Time passes beyond duration	Credentials invalid	Access denied if used
5	User tries access after expiry	Expired credentials	Access denied error	Access blocked

💡 Execution stops when temporary credentials expire and access is denied.

Status Tracker

Variable	Start	After Step 2	After Step 3	After Step 4	Final
TemporaryCredentials	None	Issued (AccessKeyId, SecretAccessKey, SessionToken)	Used for access	Expired	Invalid

Key Moments - 3 Insights

Why do temporary credentials expire?

Temporary credentials have a limited lifetime set by STS. After expiration (see execution_table step 4), they become invalid to protect security.

Can you use permanent IAM user credentials instead?

Permanent credentials exist but assuming roles provides temporary, limited access with better security (see execution_table step 2 vs 3).

What happens if the role ARN is incorrect?

STS rejects the request and no credentials are issued (not shown in table but would stop at step 1 with error).

Visual Quiz - 3 Questions

Look at the execution table, what is the output of step 2?

A Access denied error

B API call sent to STS

C Temporary credentials issued

D Credentials expired

💡 Hint

Check the 'Output' column in row for step 2 in execution_table

At which step do credentials expire?

A Step 3

B Step 4

C Step 1

D Step 5

💡 Hint

Look at the 'Action' and 'Result' columns in execution_table for expiration info

If the user tries to access resources after credentials expire, what happens?

A Access denied error

B Temporary credentials reissued automatically

C Access granted

D Session name changes

💡 Hint

See step 5 in execution_table under 'Result'

Concept Snapshot

Assuming roles lets users get temporary AWS credentials.
Use 'aws sts assume-role' with role ARN and session name.
STS returns temporary keys valid for limited time.
Use these keys to access AWS resources securely.
After expiration, credentials no longer work.
This improves security by limiting access duration.

Full Transcript

Assuming roles for temporary access means a user requests temporary credentials from AWS STS by calling the AssumeRole API with a role ARN and session name. STS returns temporary credentials including AccessKeyId, SecretAccessKey, and SessionToken. The user then uses these credentials to access AWS resources. These credentials are valid only for a limited time and expire after the set duration. Once expired, any attempt to use them results in access denied errors. This process enhances security by limiting the time window for access and avoiding use of permanent credentials.

Practice

1. What is the main benefit of assuming an AWS role for temporary access?

easy

A. It automatically deletes the AWS account after use.

B. It provides temporary, limited access without using permanent credentials.

C. It disables all access to AWS resources.

D. It creates a new permanent user with full permissions.

Solution

1. Step 1: Understand role assumption purpose

   Assuming a role grants temporary permissions without needing permanent credentials.

2. Step 2: Compare options

   Only 'It provides temporary, limited access without using permanent credentials.' correctly describes temporary, limited access. Others describe incorrect or unrelated actions.

3. Final Answer:

   It provides temporary, limited access without using permanent credentials. -> Option B

4. Quick Check:

   Temporary access = It provides temporary, limited access without using permanent credentials. [OK]

Hint: Temporary access means no permanent keys used [OK]

Common Mistakes:

• Thinking roles create permanent users
• Confusing role assumption with account deletion
• Believing role assumption disables access

2. Which AWS CLI command is used to assume a role for temporary access?

easy

A. aws sts assume-role

B. aws iam create-role

C. aws s3 ls

D. aws ec2 start-instances

Solution

1. Step 1: Identify the correct command for role assumption

   The AWS CLI command to assume a role is aws sts assume-role.

2. Step 2: Eliminate unrelated commands

   Commands like aws iam create-role create roles but do not assume them; others manage services unrelated to role assumption.

3. Final Answer:

   aws sts assume-role -> Option A

4. Quick Check:

   Assume role command = aws sts assume-role [OK]

Hint: Assume role uses 'sts' service in CLI [OK]

Common Mistakes:

• Using 'iam create-role' instead of 'sts assume-role'
• Confusing service commands like s3 or ec2
• Typing incorrect command syntax

3. What is the expected output when running this command?

aws sts assume-role --role-arn arn:aws:iam::123456789012:role/demo --role-session-name testSession

medium

A. A JSON with temporary security credentials including AccessKeyId, SecretAccessKey, and SessionToken.

B. An error saying 'role not found' because the ARN is invalid.

C. A list of all IAM users in the account.

D. A confirmation message that the role was created.

Solution

1. Step 1: Understand the command output

   The aws sts assume-role command returns temporary credentials in JSON format.

2. Step 2: Analyze options

   Only 'A JSON with temporary security credentials including AccessKeyId, SecretAccessKey, and SessionToken.' correctly describes the expected JSON output with temporary keys. Others describe errors or unrelated outputs.

3. Final Answer:

   A JSON with temporary security credentials including AccessKeyId, SecretAccessKey, and SessionToken. -> Option A

4. Quick Check:

   Assume-role output = temporary credentials JSON [OK]

Hint: Assume-role returns temporary keys in JSON [OK]

Common Mistakes:

• Expecting role creation confirmation instead of credentials
• Confusing assume-role output with user listing
• Assuming error without verifying ARN

4. You run aws sts assume-role but get an 'AccessDenied' error. What is the most likely cause?

medium

A. The AWS CLI is not installed on your machine.

B. The AWS account is suspended.

C. The role session name is missing from the command.

D. The IAM user or role does not have permission to assume the specified role.

Solution

1. Step 1: Understand 'AccessDenied' meaning

   This error means the caller lacks permission to perform the action.

2. Step 2: Identify permission requirements for assume-role

   The IAM user or role must have explicit permission to assume the target role.

3. Final Answer:

   The IAM user or role does not have permission to assume the specified role. -> Option D

4. Quick Check:

   AccessDenied = missing assume-role permission [OK]

Hint: AccessDenied usually means missing assume-role permission [OK]

Common Mistakes:

• Assuming CLI installation causes AccessDenied
• Ignoring required role session name
• Blaming account suspension without checking permissions

5. You want to allow an EC2 instance to assume a role temporarily to access S3 buckets. Which combination is correct?

hard

A. Manually run aws sts assume-role on the EC2 instance without any IAM role attached.

B. Create an IAM user with S3 permissions and store its permanent keys on the EC2 instance.

C. Attach an IAM role with S3 permissions to the EC2 instance and use the instance profile to assume the role automatically.

D. Attach a security group to the EC2 instance that allows S3 access.

Solution

1. Step 1: Understand EC2 role usage

   Attaching an IAM role to EC2 via instance profile allows automatic temporary credentials for S3 access.

2. Step 2: Evaluate other options

   Manually running aws sts assume-role without an attached IAM role fails due to lack of initial credentials. Using permanent IAM user keys is less secure. Security groups control network access, not IAM permissions.

3. Final Answer:

   Attach an IAM role with S3 permissions to the EC2 instance and use the instance profile to assume the role automatically. -> Option C

4. Quick Check:

   EC2 uses instance profile role for temporary access [OK]

Hint: Use instance profile roles for EC2 temporary access [OK]

Common Mistakes:

• Using permanent keys on EC2 instead of roles
• Trying to assume role without attached IAM role
• Confusing security groups with permissions