thinQmaster Virtual testing partner Adaptive practice exams that find your weak spots and drill them. Every answer explained. From $69
Enroll

thinQmaster

Find your exam

Five questions free, before you decide.

Step 1 · choose a vendor

In one of our camps? Your practice exams come with the tuition — they are on your study page already.

Cloud Computing · Intermediate

Cross-Account Role

IAM role in one AWS account that principals in another account are trusted to assume, enabling access without sharing credentials.

Definition

The target account creates a role whose trust policy names the other account or specific principals, optionally requiring an external ID or MFA. The source account grants its principals sts:AssumeRole on that role ARN. This is the standard way to delegate access between accounts and to third parties.

Example

A security tooling account assumes a SecurityAudit role in every member account to collect configuration data.

Exam tip

For third-party access, require an external ID in the trust policy to prevent the confused deputy problem.

Related terms