4 ms·
As mentioned, AssumeRole is a critical part of a multi-account strategy, which is considered an AWS best practice. In addition to that, it is an integral part o
by time0ut 7y ago
As mentioned, AssumeRole is a critical part of a multi-account strategy, which is considered an AWS best practice. In addition to that, it is an integral part of an SSO strategy. Ideally, instead of a pile of IAM users with separate credentials, user identities should be federated from your identity provider (like Auth0, Ping, AzureAD, whatever). There are a number of setups, but they all boil down to your users trading their corporate identity for temporary AWS credentials via something like an AssumeRoleWithSAML call. This is only slightly more complicated to set up than a good IAM user/group architecture, but has the benefit of not needing to deal with IAM users and multiple sets of identities for your users. You can also map particular roles back to something like AD groups to control who can assume what.
- antoncohen 7y agoThanks, that was a very clear explanation. I know AssumeRole is needed for SSO, and I understand the benefits of SSO. The way the article phrased it it sounded like AssumeRole has some very specific benefit by itself. And if the answer is "short lived credential", then I'd like to understand how short lived credentials that require a long lived credentials to get them are better than long lived credentials, if both can be just as easily revoked.