Organizations run many AWS accounts, and applications often need to reach resources in another account: a build pipeline deploying to production, a reporting job reading a data account's bucket. The standard, secure way to do this is for the caller to assume a role in the target account, receiving short-lived credentials, instead of creating IAM users with long-term keys in every account.
Free account
Keep reading for free
Create a free StudyToCert account to read the rest of this lesson: 6 more sections, 5 key terms, a real-world example, an exam tip and self-check questions. Every lesson, lab and practice test is free with an account.