Contents
How do I enable assume role?
STEP-2: Granting Access to the Role
- Navigate to IAM > Policies, and click on Create Policy.
- Configure the policy with sts:AssumeRole action and provide the resource reference for Prod-Xacc-Access role’s ARN, which in this example is arn:aws:iam::112233445566:role/Prod-Xacc-Access.
How can a user assume a role?
Because this IAM role is assumed by an IAM user, you must specify a principal that allows IAM users to assume that role. For example, a principal similar to arn:aws:iam::123456789012:root allows all IAM identities of the account to assume that role.
How to link user to multiple…roles?
In that table you can insert the same userID with different roleID, so that it will allow users to have multiple roles. Likewise, you’d need to create the UI to allow admin users to assign different roles. In my case I used a ListBox to display the existing roles in the application, which allows the multiple selection.
How to relate the same user to different roles?
In order to relate the same user to different roles there should be a table called asp_net_usersinroles. In that table you can insert the same userID with different roleID, so that it will allow users to have multiple roles. Likewise, you’d need to create the UI to allow admin users to assign different roles.
Why do I need to enable allow log on locally?
Any account with the Allow log on locally user right can log on to the console of the device. If you do not restrict this user right to legitimate users who must log on to the console of the computer, unauthorized users could download and run malicious software to elevate their privileges.
How to grant a user permissions to switch roles?
To do this, the administrator of the trusting account specifies the trusted account number as the Principal in the role’s trust policy. That allows potentially any user in the trusted account to assume the role.